716e37a0fd995413ba0a6c0aa788a74d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

716e37a0fd995413ba0a6c0aa788a74d_JaffaCakes118
Size

52KB
MD5

716e37a0fd995413ba0a6c0aa788a74d
SHA1

d0d17e4e7768a49e1b19aa921529d43a2a17d3d1
SHA256

62c190504eef4b2484144af54a1f848a3be0ad06dabb37f344122606b247ed09
SHA512

2c5c4d243a06f5009846023b43c0bac85b1db29f6015c05f3cf56041835397ef547cd29103a1cc07cc7311aa4a41c0597219f49cf48b1d9e319227c340221b65
SSDEEP

768:SlyAayG0L/ICQKixX70EjJnZItUNCNAijCoxzE1RD/eWLI9x7AAnMF+sR:MFV/I1Pxpj1WRNAQCo5ELK4Q7AAnMF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
716e37a0fd995413ba0a6c0aa788a74d_JaffaCakes118

Files

716e37a0fd995413ba0a6c0aa788a74d_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

fb17d5208b4effb10b45f68ac2cae802

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
MoveFileA
SetFileAttributesA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
Process32Next
Process32First
CreateThread
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
RemoveDirectoryA
CreateDirectoryA
GetCommandLineW
GetProcAddress
LoadLibraryA
FreeLibrary
LocalFree
Sleep
DeleteFileA
WritePrivateProfileStringA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
ExitProcess

advapi32

RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA

ole32

CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize

oleaut32

SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString

msvcrt

strrchr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
_wcslwr
wcsstr
strcmp
memcmp
_access
atoi
strcpy
memset
sprintf
??3@YAXPAX@Z
fclose
fread
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
_strupr
strstr
strncpy
strchr
strncmp
strlen

shlwapi

SHSetValueA
SHDeleteKeyA
SHDeleteValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb17d5208b4effb10b45f68ac2cae802

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB