62002dfc88168344ac4d13992db29754_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

62002dfc88168344ac4d13992db29754_JaffaCakes118
Size

416KB
MD5

62002dfc88168344ac4d13992db29754
SHA1

8709b536d0c5b38ab3b46804fc7bcb83d23fc1f9
SHA256

320ad680d77ea4bdc2f19f909f4e89a4b90d760fcc2afc530d299b5e106e02b4
SHA512

06253c36f2ddea565c08da8d8141c9eae9a137f1cdb65ba413147f4d0933e0568d83ddba98f8c943f44e42bac7f1d843ee84b02c948506c5ee6ce5ac4bbdc1bc
SSDEEP

6144:ksL4FaUqY5uqMxuAurXtNTx/GeAQSqDr1a9wOZ9yYB1k9JwWKYcJTS:3LhG6EAurnTkeJ1DrM9tZWKYW2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
62002dfc88168344ac4d13992db29754_JaffaCakes118

Files

62002dfc88168344ac4d13992db29754_JaffaCakes118
.dll windows:4 windows x86 arch:x86

dbcf85d7d2053aa73658ffca382d85b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dinput8

DirectInput8Create

kernel32

SetEvent
InitializeCriticalSection
DeleteCriticalSection
SetThreadContext
GetThreadContext
LoadLibraryA
CreateThread
lstrlenW
SetLastError
MapViewOfFile
IsDebuggerPresent
GetFileAttributesW
GetFileAttributesA
SetFilePointer
GetFullPathNameA
lstrlenA
GetLastError
SetFilePointerEx
GetFileSize
GetFileSizeEx
WaitForSingleObject
CreateEventA
ResumeThread
TerminateProcess
CreateProcessA
CreateProcessW
FindNextFileA
FindFirstFileExA
GetFileAttributesExA
GetTickCount
CopyFileA
CopyFileExA
DeleteFileA
MoveFileA
MoveFileExA
ReplaceFileA
LoadLibraryW
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
MapViewOfFileEx
FindNextFileW
FindFirstFileW
FindFirstFileExW
GetFileAttributesExW
SetFileAttributesW
CopyFileW
CopyFileExW
DeleteFileW
MoveFileW
MoveFileExW
ReplaceFileW
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
DisableThreadLibraryCalls
WaitForMultipleObjects
SetFileAttributesA
InterlockedExchange
EnterCriticalSection
TerminateThread
LeaveCriticalSection
VirtualQuery
UnmapViewOfFile
CreateFileMappingW
CreateFileMappingA
GetCurrentThread
FlushInstructionCache
ExitProcess
SetUnhandledExceptionFilter
OutputDebugStringA
FindFirstFileA
FindClose
GetSystemInfo
VirtualAlloc
VirtualProtect
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
VirtualFree
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateFileA
ReadFile
GetModuleFileNameA
GetCurrentDirectoryA
WriteFile
FreeLibrary
LocalFree
VirtualFreeEx
ReadProcessMemory
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetWindowsDirectoryA
InterlockedDecrement
GetVolumeInformationA
DeviceIoControl
HeapFree
HeapAlloc
IsBadReadPtr
CreateDirectoryA
CreateMutexA
ReleaseMutex
InterlockedIncrement
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
HeapSize
IsBadCodePtr
GetOEMCP
SetStdHandle
FlushFileBuffers
SetEndOfFile
CloseHandle
Sleep

user32

FindWindowA
CharUpperBuffA
MessageBoxA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RevertToSelf
ImpersonateSelf
RegSetValueExA
RegSetKeySecurity
RegCloseKey
GetUserNameA
RegQueryMultipleValuesW
RegQueryMultipleValuesA
RegQueryValueExW
RegQueryValueExA
RegQueryValueW
RegQueryValueA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCreateKeyW
RegCreateKeyA

shell32

ShellExecuteExW
ShellExecuteExA
SHGetSpecialFolderPathA
SHGetFolderPathA
SHGetMalloc
ShellExecuteA
ShellExecuteW
SHGetPathFromIDListA
SHGetDesktopFolder

iphlpapi

GetAdaptersInfo

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateGuid
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
VariantInit
VariantChangeType
VariantClear
SysAllocString

Exports

Exports

_InitAP2@4
_InitAP@0

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aecode
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pecode
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aphr
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbcf85d7d2053aa73658ffca382d85b5

Headers

File Characteristics

Imports

dinput8

kernel32

user32

advapi32

shell32

iphlpapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 178KB - Virtual size: 177KB

.aecode Size: 38KB - Virtual size: 38KB

.pecode Size: 21KB - Virtual size: 20KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 11KB - Virtual size: 19KB

.aphr Size: 4KB - Virtual size: 3KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 178KB - Virtual size: 177KB

.aecode
Size: 38KB - Virtual size: 38KB

.pecode
Size: 21KB - Virtual size: 20KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 11KB - Virtual size: 19KB

.aphr
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 20KB - Virtual size: 19KB