62e4be805ec98117025368868774037e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

62e4be805ec98117025368868774037e_JaffaCakes118
Size

145KB
MD5

62e4be805ec98117025368868774037e
SHA1

933e4ec8f371caba001e57eb21a07d0d34bc7184
SHA256

1bf4613031a62a96ef502735cff0675f1ad8881defa5d9b2fc52f2cd39691ca3
SHA512

05cd2208277b89ee20cd7982765133843bc21cc036fbc64e9ed055f68c5619588c558b1a373e41ac8a008704aae53427d6367c708ece73ebc8e812ec2da683c3
SSDEEP

3072:y8//8TQEkQ9jHYkpdC3Kqaecuqb6XN5ZZzI3FWdir:yKIGQZ9pdC3Hae/XN5PzI3br

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
62e4be805ec98117025368868774037e_JaffaCakes118

Files

62e4be805ec98117025368868774037e_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ae5f944e2dfecb76e2c621e46c8b6ce2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
WaitForSingleObject
CreateThread
GetOEMCP
GetOverlappedResult
CreateEventW
CreateNamedPipeW
WriteConsoleInputW
GenerateConsoleCtrlEvent
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
GetConsoleDisplayMode
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
ReadConsoleOutputW
FreeConsole
GetStdHandle
SetConsoleCtrlHandler
GetConsoleWindow
AllocConsole
GetComputerNameW
GetTickCount
QueryPerformanceCounter
GetSystemTime
GetLocalTime
ExpandEnvironmentStringsW
GetFileAttributesW
GetModuleFileNameW
OpenProcess
GetWindowsDirectoryW
DeleteFileW
GetModuleHandleA
GetExitCodeThread
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
ResumeThread
lstrcatW
QueueUserAPC
GetSystemDefaultLCID
GlobalMemoryStatus
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
ProcessIdToSessionId
GetCurrentProcessId
TlsFree
SetUnhandledExceptionFilter
TerminateThread
GetCurrentThread
TlsGetValue
TlsAlloc
lstrcpyA
lstrcpynA
DisconnectNamedPipe
ResetEvent
CancelIo
GetSystemInfo
GetVersionExW
GetProcessHeap
HeapFree
CreateProcessW
CreateDirectoryW
GetFileSize
ReadFile
CreateFileW
GetFileTime
SetFilePointer
CloseHandle
WriteFile
SetEndOfFile
FlushFileBuffers
SetFileTime
FindFirstFileW
FindNextFileW
FindClose
QueryDosDeviceW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetErrorMode
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
lstrlenW
VirtualFree
VirtualAlloc
GetPrivateProfileSectionA
LoadLibraryA
GetProcAddress
OutputDebugStringW
GetCommandLineW
lstrcmpiW
LocalFree
ExitProcess
Sleep
MoveFileExW
GetCurrentProcess
TerminateProcess
GetStartupInfoW
SetFileShortNameW
WaitForMultipleObjects
lstrcpyW
SetEvent
TlsSetValue
GetSystemDirectoryW
GetLastError
IsProcessorFeaturePresent

user32

wsprintfA
MessageBoxA
GetSystemMetrics
SetWindowsHookExW
GetForegroundWindow
GetWindowTextW
GetClassNameW
GetAsyncKeyState
GetKeyState
CallNextHookEx
UnhookWindowsHookEx
GetMessageW
FindWindowA
GetWindowThreadProcessId
CreateWindowExW
SetWindowLongW
SetTimer
MsgWaitForMultipleObjectsEx
KillTimer
DestroyWindow
DefWindowProcW
PeekMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
ExitWindowsEx
PostMessageA
SetCursorPos
keybd_event
mouse_event
OpenWindowStationW
GetProcessWindowStation
SetProcessWindowStation
OpenInputDesktop
GetThreadDesktop
SetThreadDesktop
CloseWindowStation
GetIconInfo
DestroyIcon
CreateDesktopW
CloseDesktop
wsprintfW
GetDlgItemTextW
DialogBoxParamW
DrawTextExW
GetSysColorBrush
LoadImageA

gdi32

GetDeviceCaps
BitBlt
GdiFlush
SetDIBColorTable
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateDCW
SetMetaFileBitsEx
OffsetWindowOrgEx
DeleteDC
GetDIBits
DeleteObject

advapi32

RegSetValueExW
RegEnumValueA
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
AllocateAndInitializeSid
EqualSid
FreeSid
QueryServiceStatusEx
CreateServiceW
ChangeServiceConfig2W
GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerExW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
DeleteService
ChangeServiceConfigW
QueryServiceConfigW
QueryServiceConfig2W
EnumServicesStatusW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
InitiateSystemShutdownA
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
LookupAccountSidW
GetLengthSid

Exports

Exports

JarCu
JarHlyxs

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae5f944e2dfecb76e2c621e46c8b6ce2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 112KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 6KB - Virtual size: 357KB

.CRT Size: 512B - Virtual size: 4B

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 112KB - Virtual size: 112KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 6KB - Virtual size: 357KB

.CRT
Size: 512B - Virtual size: 4B

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 10KB - Virtual size: 10KB