620039ec72e6c38ddd9850fc2c00848b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

620039ec72e6c38ddd9850fc2c00848b_JaffaCakes118
Size

2.5MB
MD5

620039ec72e6c38ddd9850fc2c00848b
SHA1

69ae27b6371b551f67db976d4aad800ac83ff0cf
SHA256

2f3fcd713431db8bf7cd517ca6c510a981e0ae92aad354fa7110f84c2beceb4c
SHA512

ac11b53a1552c70faba0522524d77b23bdf4403a3086fa9591b212f23bff3391f11870e5d0719c8d0ac1cace9ce12186b504945f689b661e09011e7c4e4616ae
SSDEEP

49152:UNN3GaanfJUHrnU5NdpD5EBJ3P9gTWjTn:UNRqfL5p5Ex9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
620039ec72e6c38ddd9850fc2c00848b_JaffaCakes118

Files

620039ec72e6c38ddd9850fc2c00848b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

07bf765a4f7efcf56f172eac25d6ec5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mcgc.pdb

Imports

kernel32

GetThreadPriority
GetCurrentThread
IsBadReadPtr
VirtualProtect
VirtualAlloc
IsBadCodePtr
VirtualFree
GetProcAddress
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessW
GetTempFileNameW
GetFileTime
VirtualUnlock
VirtualLock
IsBadWritePtr
LoadLibraryW
GetSystemDirectoryW
CompareFileTime
SetEnvironmentVariableW
GetEnvironmentVariableW
SetThreadPriority
CreateFileW
GetFileSize
GetProcessHeap
HeapAlloc
ReadFile
HeapFree
DeleteFileW
CreateEventW
ResetEvent
UnmapViewOfFile
InterlockedExchange
InterlockedExchangeAdd
GetComputerNameW
LocalFree
FindResourceExW
LockResource
WideCharToMultiByte
GetCurrentProcess
DuplicateHandle
SetEvent
SetEndOfFile
SetEnvironmentVariableA
lstrlenA
GetCurrentProcessId
ProcessIdToSessionId
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
GetTickCount
GetTempPathW
TerminateThread
CreateThread
ReleaseMutex
WaitForSingleObject
CloseHandle
CreateMutexW
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcmpiW
GetLastError
lstrlenW
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetFileAttributesExW
GetModuleFileNameW
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
HeapCreate
FatalAppExitA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
lstrcpynW
WriteFile
CreateMutexA
lstrcpynA
Process32NextW
LocalAlloc
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThreadId
GetSystemTime
GlobalUnlock
GlobalLock
GlobalSize
CreateSemaphoreW
CreateDirectoryW
lstrcatW
lstrcpyW
FindClose
FindNextFileW
SetFileAttributesW
SetFileTime
GetSystemTimeAsFileTime
FindFirstFileW
ReleaseSemaphore
GetExitCodeThread
Sleep
GetVersionExW
GetTimeZoneInformation
FileTimeToDosDateTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetLocalTime
SetFilePointer
GetFileInformationByHandle
GlobalAlloc
GlobalFree
GlobalReAlloc
CreateFileA
lstrcpyA
ExpandEnvironmentStringsW
GetComputerNameExW
GetFileAttributesW
FindNextFileA
FindFirstFileA
SetLastError
CopyFileW
RemoveDirectoryW
LoadLibraryA
SetCurrentDirectoryA
GetModuleFileNameA
GetCurrentDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
ExitThread
FileTimeToSystemTime
GetModuleHandleA
ExitProcess
GetCPInfo
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
InterlockedCompareExchange

user32

CharNextW
GetForegroundWindow
IsWindowVisible
PostThreadMessageW
UnregisterClassA
CharLowerA
PeekMessageW
GetWindowThreadProcessId
MsgWaitForMultipleObjects
PostMessageW
DispatchMessageW
SetWindowTextW
CharLowerBuffW
GetWindowDC
GetSystemMetrics
GetDesktopWindow
GetWindowRect
CharLowerW
GetWindowTextW
GetParent
FindWindowExW
GetClassNameW
TranslateMessage
MessageBoxW
IsWindow

gdi32

CreateCompatibleBitmap
SelectObject
BitBlt
GetObjectW
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC

advapi32

CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegGetKeySecurity
RegOpenKeyW
RegSetKeySecurity
RegQueryValueExW
LookupAccountNameW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RevertToSelf
OpenThreadToken
ImpersonateLoggedOnUser
LookupAccountSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetTokenInformation
DuplicateTokenEx
IsValidSid
GetTokenInformation
SetNamedSecurityInfoW
ConvertStringSidToSidW
CryptDestroyKey
InitiateSystemShutdownExW
GetSidSubAuthority
GetSidSubAuthorityCount
CryptEncrypt
CryptDecrypt
CryptDeriveKey
CryptAcquireContextW

ole32

CoInitializeEx
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
GetHGlobalFromStream
CoUninitialize

oleaut32

VariantChangeType
SafeArrayCreate
SafeArrayCreateVector
SystemTimeToVariantTime
SafeArrayGetElement
VariantInit
VarBstrCmp
VarBstrFromI4
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
SysAllocString
VarUI4FromStr
SafeArrayPutElement
SafeArrayDestroy
VarBstrCat
SafeArrayRedim
SafeArrayAccessData
SafeArrayUnaccessData
VarI4FromStr
CreateErrorInfo
SetErrorInfo
GetErrorInfo

shlwapi

PathSkipRootW
PathAppendW
PathFileExistsW
PathStripPathW
SHCreateStreamOnFileW
PathAppendA
PathFindFileNameA
PathRemoveFileSpecA
PathIsDirectoryA
PathMatchSpecW
PathFindFileNameW
PathRemoveFileSpecW
PathSkipRootA
PathIsDirectoryW
PathMatchSpecA

version

GetFileVersionInfoW
VerQueryValueW

psapi

GetModuleFileNameExW

shell32

SHGetFolderPathW

wtsapi32

WTSOpenServerW
WTSQuerySessionInformationW
WTSCloseServer
WTSFreeMemory

netapi32

NetWkstaUserEnum
NetApiBufferFree

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 840KB - Virtual size: 837KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07bf765a4f7efcf56f172eac25d6ec5b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

version

psapi

shell32

wtsapi32

netapi32

rpcrt4

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 840KB - Virtual size: 837KB

.data Size: 44KB - Virtual size: 55KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 60KB - Virtual size: 58KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 840KB - Virtual size: 837KB

.data
Size: 44KB - Virtual size: 55KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 60KB - Virtual size: 58KB