5d916c640d48bf188b8e32bea81ea88b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5d916c640d48bf188b8e32bea81ea88b_JaffaCakes118
Size

64KB
MD5

5d916c640d48bf188b8e32bea81ea88b
SHA1

eeec384250b52902341c93810a41909cfc4ee816
SHA256

eaa4ab2547b05aa317b952083603883c78fb338a065b7f6724772c83c08b1dcc
SHA512

5a4fef47b60e3458ac05fcef5baaead45236c5c835a7175dda3057da81d7e32b70e280f16859b3b1cb791a73fef63eba03d8a02cd3c9fef9b5485a124018c2b7
SSDEEP

768:woDrfdTcdjh4Hf+6QA6vJjhVk+3DLEYcSsrYWyyxrVaIkGRK+HEluoji5ii9GSVc:wwdTkN4/1FEVkEySmFVaEKxLHiQS2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d916c640d48bf188b8e32bea81ea88b_JaffaCakes118

Files

5d916c640d48bf188b8e32bea81ea88b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e2f24c9db12665486ff2e92641b4b1c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

strtok
strcmp
strcat
memcpy
tolower
wcslen
wcscpy
malloc
free
_except_handler3
_strupr
exit
fputc
fwrite
memcmp
fread
fseek
__CxxFrameHandler
_initterm
_adjust_fdiv
_strrev
_strnicmp
strstr
memset
strcspn
strncpy
strcpy
atoi
_vsnprintf
sprintf
fopen
fputs
fclose
strlen
_wcsicmp

kernel32

GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
SetFileTime
GetFileTime
CreateFileA
FindClose
FindFirstFileA
SetLastError
FormatMessageA
LocalFree
GetLocalTime
FreeResource
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
GetCurrentProcess
CreateProcessA
lstrlenA
OpenProcess
GetVersion
DeleteFileA
GetLongPathNameA
GetTempPathA
GetSystemDirectoryA
GetDriveTypeA
FindNextFileA
MoveFileExA
SetFileAttributesA
CreateDirectoryA
RemoveDirectoryA
MultiByteToWideChar
GetACP
FreeLibrary
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
VirtualProtectEx
GetTickCount
CreateThread
GetModuleHandleA
GlobalFree
SetFilePointer
lstrcatA
GlobalAlloc
lstrlenW
ReleaseMutex
CopyFileA
GetSystemWindowsDirectoryA
VirtualAlloc
ReadFile
GetFileSize
VirtualFree
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
TerminateProcess
GlobalReAlloc
GlobalLock
GlobalSize
GlobalMemoryStatus
GlobalUnlock
GetEnvironmentVariableA
GetStartupInfoA
CreatePipe
GetCurrentDirectoryA
DeviceIoControl
LoadLibraryExA
OpenMutexA
TerminateThread
GetVersionExA
GetModuleFileNameA
GetCurrentThreadId
WideCharToMultiByte
WaitForSingleObject
GetLastError
Sleep
GetCurrentProcessId
VirtualProtect

user32

GetDesktopWindow
FindWindowA
SetThreadDesktop
CloseWindowStation
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
ExitWindowsEx
LockWorkStation
ShowCursor
ClipCursor
SetWindowPos
ShowWindow
IsRectEmpty
SendMessageA
IsWindow
DefWindowProcA
SetTimer
PostQuitMessage
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
CallNextHookEx
GetWindowTextA
GetWindowDC
GetDC
ReleaseDC
mouse_event
SetCursorPos
UnhookWindowsHookEx
EnableWindow
wsprintfW
MessageBoxA
GetSystemMetrics
wsprintfA
SetWindowsHookExA
GetActiveWindow

gdi32

CreateCompatibleDC
CreateDCA
GetDIBits
RealizePalette
GetDeviceCaps
CreateCompatibleBitmap
SelectPalette
GetObjectA
GetStockObject
DeleteObject
StretchBlt
DeleteDC
SelectObject

advapi32

RegOpenKeyExA
LookupPrivilegeValueA
OpenProcessToken
DeleteService
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CloseEventLog
ClearEventLogA
OpenEventLogA
LsaNtStatusToWinError
LsaClose
RegOpenKeyA
StartServiceA
GetUserNameA
RegQueryValueExA
RegCreateKeyA
AdjustTokenPrivileges
RegSetValueExA
RegCloseKey
GetTokenInformation
LookupAccountSidA
LsaOpenPolicy
LsaRetrievePrivateData

shell32

ShellExecuteA

ws2_32

gethostname
gethostbyname
getsockopt
socket
ioctlsocket
bind
listen
select
recv
inet_addr
setsockopt
connect
send
htons
closesocket
WSAStartup
WSACleanup

sfc

SfcIsFileProtected

psapi

EnumProcessModules
GetModuleFileNameExA

urlmon

URLDownloadToFileA

wininet

GetUrlCacheEntryInfoA

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

Exports

Exports

Entry
GetCfg
InfectFile
Init
InstallHook
ResetSSDT
UnHook
Uninstall
_EventLogon@4
_EventStartup@4

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2f24c9db12665486ff2e92641b4b1c1

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ws2_32

sfc

psapi

urlmon

wininet

imm32

avicap32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 5KB - Virtual size: 12KB

.sdata Size: 512B - Virtual size: 24B

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 5KB - Virtual size: 12KB

.sdata
Size: 512B - Virtual size: 24B

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB