6637a8853c5197fdd524741f24e2b37d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6637a8853c5197fdd524741f24e2b37d_JaffaCakes118
Size

384KB
MD5

6637a8853c5197fdd524741f24e2b37d
SHA1

6920d52ff2aa74bba0d760dfadd7fa720686789e
SHA256

5d43fd9a6230331c64cbef461d42e144632b06251b4e46213e85be59c7eeba92
SHA512

27989eda1624e63a2336151ac41dae213daf1f6f03fdb7e8899cb253113bb171269afe572b244874a0eaf8b3f89d8bec33b0cc6480ec90f2fb82e18d269d55a6
SSDEEP

6144:u2eXDRsnXKi1wjhKIlnIWZ0Wnic9i6jBLvuHAkc1xV6tXsoovk9u2rc:t+QzdEEc9fjNvuw1T6BQ2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6637a8853c5197fdd524741f24e2b37d_JaffaCakes118

Files

6637a8853c5197fdd524741f24e2b37d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

13ce0187d9ef32b89365503c657e45ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2726
ord2614
ord924
ord565
ord817
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5715
ord5289
ord5307
ord4699
ord4079
ord5303
ord5300
ord3346
ord2396
ord4226
ord1948
ord5572
ord2764
ord6877
ord4202
ord5683
ord5710
ord2860
ord1640
ord5785
ord2405
ord2414
ord640
ord6385
ord3318
ord1641
ord289
ord613
ord2915
ord858
ord939
ord1187
ord533
ord5194
ord3811
ord3337
ord2818
ord6407
ord1997
ord798
ord540
ord860
ord535
ord537
ord356
ord2770
ord1980
ord668
ord800
ord1575
ord1182
ord342
ord1253
ord354
ord5186
ord861
ord833
ord2814
ord3876
ord6069
ord2117
ord6000
ord6067
ord5655
ord6334
ord3092
ord2642
ord6199
ord2302
ord2370
ord2289
ord529
ord656
ord796
ord4853
ord4376
ord3610
ord6662
ord926
ord500
ord2086
ord5860
ord6142
ord772
ord2763
ord4277
ord6283
ord541
ord801
ord6929
ord758
ord475
ord4710
ord4234
ord641
ord324
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord5265
ord6453
ord1146
ord2859
ord3571
ord2820
ord6383
ord5440
ord6215
ord4299
ord5787
ord3573
ord2379
ord6380
ord6197
ord562
ord816
ord5875
ord5789
ord3626
ord3619
ord4275
ord1949
ord2107
ord2044
ord2448
ord2841
ord6394
ord5834
ord5450
ord3663
ord536
ord2781
ord4058
ord3178
ord941
ord4278
ord5856
ord4129
ord1168
ord567
ord1233
ord6442
ord818
ord3742
ord4627
ord3402
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord5858
ord6140
ord654
ord341
ord2256
ord323
ord665
ord5773
ord5442
ord1979
ord823
ord825
ord1200

msvcrt

_except_handler3
memmove
_vsnprintf
sprintf
wcscmp
strrchr
_strlwr
_mbscmp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
atoi
strncpy
strncmp
exit
__CxxFrameHandler
memcpy
memset
_callnewh
strcat
strlen
printf
time
rand
srand
_CxxThrowException
strcmp
strcpy
fprintf
_iob
free
calloc
malloc
realloc
memcmp
??0exception@@QAE@ABV0@@Z
_ftol
abs
_purecall
system
_flushall
getenv
strstr
wcstombs
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CIpow
_CIacos
wcsstr
_mbsicmp
sscanf
_strupr

kernel32

UnmapViewOfFile
CreateMutexA
ExitProcess
ExitThread
GetPrivateProfileStringA
Beep
GlobalMemoryStatus
GetLogicalDrives
lstrcmpiA
GetComputerNameA
GetVolumeInformationA
InterlockedDecrement
QueryPerformanceCounter
QueryPerformanceFrequency
GetEnvironmentVariableW
GetProcessHeap
HeapAlloc
HeapFree
GetSystemInfo
VirtualQueryEx
MultiByteToWideChar
SetLastError
GetExitCodeThread
lstrlenW
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
ReadProcessMemory
VirtualFreeEx
GetLocalTime
DuplicateHandle
DeviceIoControl
MapViewOfFile
lstrcmpA
lstrcpynA
GetVersion
GetTempPathA
GetExitCodeProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoA
RemoveDirectoryA
CreateDirectoryA
SetFilePointer
CreateFileA
GetFileSize
lstrcatA
FindFirstFileA
FindNextFileA
FindClose
GetDriveTypeA
lstrcpyA
GetDiskFreeSpaceExA
WideCharToMultiByte
LocalAlloc
GetWindowsDirectoryA
GetVersionExA
CreatePipe
SetStdHandle
GetSystemWindowsDirectoryA
GetTempFileNameA
InitializeCriticalSection
WaitForMultipleObjectsEx
DeleteCriticalSection
OpenProcess
MoveFileExA
ReadFile
EnterCriticalSection
LeaveCriticalSection
WriteFile
FreeConsole
AllocConsole
SetCurrentDirectoryA
CopyFileA
CreateProcessA
TerminateProcess
GetConsoleScreenBufferInfo
ReadConsoleOutputA
ReadConsoleOutputCharacterA
GetStdHandle
WriteConsoleInputA
TerminateThread
MoveFileA
SetFileAttributesA
DeleteFileA
WinExec
GlobalFree
GetTickCount
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalReAlloc
CreateEventA
WaitForSingleObject
SetEvent
GetSystemDirectoryA
GetLastError
FormatMessageA
lstrlenA
LocalFree
OutputDebugStringA
Sleep
GetCommandLineA
SetUnhandledExceptionFilter
Process32First
Process32Next
GetModuleFileNameA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
CreateThread
GetCurrentThreadId
GetCurrentProcessId
Thread32First
OpenThread
Thread32Next
CreateToolhelp32Snapshot
Module32First
LoadLibraryA
FreeLibrary
Module32Next
CloseHandle

user32

GetDCEx
KillTimer
EndDialog
SetTimer
SetForegroundWindow
SetWindowPos
DialogBoxParamA
RegisterWindowMessageA
EnumChildWindows
GetAsyncKeyState
GetKeyState
GetFocus
GetKeyNameTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
InternalGetWindowText
GetWindowTextA
GetWindowThreadProcessId
ShowWindow
LoadBitmapA
SetRect
CopyRect
UnregisterHotKey
SetCursorPos
GetWindowPlacement
GetTopWindow
GetWindowLongA
RegisterHotKey
IsWindowUnicode
SendMessageTimeoutA
GetWindow
EnumWindows
CharToOemA
EnumDisplayDevicesA
IsWindowVisible
GetSystemMetrics
GetWindowDC
GetWindowRect
GetDC
ReleaseDC
GetDesktopWindow
SwapMouseButton
ScreenToClient
wsprintfA
IsCharAlphaNumericA
GetCursorPos
FillRect
InvalidateRect
SetWindowRgn
SetWindowLongA
DefWindowProcA
LoadIconA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
GetClientRect
LoadCursorA
SendMessageA
CloseWindow
CreateWindowExA
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
OpenInputDesktop
GetUserObjectInformationA
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
CloseDesktop
GetClassNameA
PostMessageA
GetCursor
IsRectEmpty
PostThreadMessageA
WindowFromPoint
PostQuitMessage
GetIconInfo
DestroyIcon
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
ExitWindowsEx
SystemParametersInfoA
EnableWindow
keybd_event
mouse_event
MessageBoxA

gdi32

CreateBitmap
CreatePatternBrush
PatBlt
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontIndirectA
BeginPath
EndPath
PathToRegion
GetDeviceCaps
GetBitmapBits
CreateDCA
GetPixel
GetStockObject
SelectPalette
RealizePalette
CreateCompatibleBitmap
CreateDIBSection
BitBlt
DeleteObject
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBits
DeleteDC

advapi32

RevertToSelf
SetKernelObjectSecurity
FreeSid
GetSecurityInfo
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
GetUserNameA
SetSecurityInfo
RegEnumKeyExA
RegDeleteValueA
EnumServicesStatusA
DeleteService
ChangeServiceConfigA
ControlService
StartServiceA
OpenSCManagerA
CloseServiceHandle
OpenServiceA
QueryServiceConfigA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
CreateProcessAsUserA
DuplicateTokenEx
ImpersonateLoggedOnUser
GetKernelObjectSecurity
GetSecurityDescriptorDacl
SetEntriesInAclA
MakeAbsoluteSD
DeregisterEventSource
ReportEventA
RegisterEventSourceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
AllocateAndInitializeSid
BuildTrusteeWithSidA
SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathA
ShellExecuteA
SHGetFileInfoA
ExtractIconExA

ole32

CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoInitialize

olepro32

ord251

oleaut32

VariantChangeType
VariantInit
SysAllocString
VariantClear
SysFreeString
GetErrorInfo

urlmon

URLDownloadToFileA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?nothrow@std@@3Unothrow_t@1@B
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wininet

InternetCheckConnectionA
InternetGetConnectedState
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvfw32

ICInfo
ICGetInfo
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICSeqCompressFrame
ICCompressorFree
ICSeqCompressFrameEnd

shlwapi

SHDeleteValueA
SHDeleteKeyA

imm32

ImmReleaseContext
ImmGetCompositionStringA
ImmGetContext

ntdll

ZwOpenSection
RtlInitUnicodeString
ZwOpenFile
ZwQuerySystemInformation
_strnicmp
_stricmp
_strcmpi
_wcsicmp
wcslen

winmm

mciSendStringA
waveOutGetNumDevs
waveOutGetDevCapsA
mixerGetID
mixerOpen
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerClose
sndPlaySoundA
timeGetTime
waveInUnprepareHeader
waveInStop
waveInReset
waveInClose
waveInGetErrorTextA
waveOutSetVolume
waveOutOpen
waveOutGetErrorTextA
waveOutClose
waveOutReset
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen

ws2_32

listen
inet_ntoa
WSAAsyncSelect
setsockopt
socket
__WSAFDIsSet
gethostname
WSACleanup
WSAStartup
recv
send
WSARecv
WSASend
recvfrom
getpeername
WSAAsyncGetHostByName
sendto
getsockname
ntohs
WSACloseEvent
WSACreateEvent
WSASocketA
bind
htonl
htons
accept
select
ioctlsocket
connect
gethostbyname
inet_addr
WSAGetLastError
closesocket
WSAGetOverlappedResult
WSAResetEvent
WSAWaitForMultipleEvents
WSAConnect

iphlpapi

GetAdaptersInfo

Exports

Exports

start
test

Sections

.text
Size: 224KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13ce0187d9ef32b89365503c657e45ce

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

urlmon

msvcp60

wininet

msvfw32

shlwapi

imm32

ntdll

winmm

ws2_32

iphlpapi

Exports

Exports

Sections

.text Size: 224KB - Virtual size: 222KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 60KB - Virtual size: 2.6MB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 36KB - Virtual size: 32KB

.text
Size: 224KB - Virtual size: 222KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 60KB - Virtual size: 2.6MB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 36KB - Virtual size: 32KB