72a3e0789ca73c0bffd6f881c1b30848_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

72a3e0789ca73c0bffd6f881c1b30848_JaffaCakes118
Size

111KB
MD5

72a3e0789ca73c0bffd6f881c1b30848
SHA1

6eeb6269ea1f5097707e113e37ba28d10297b4d8
SHA256

9a5dc6ef248992bd517cebe6af544efc20f4201a9fff394bb8555e7928ede43d
SHA512

c64a0122944b8e41bb58320d90eec97d444090883d207fd7bcdead14a3b48228c7f0c61b1dc4cfc595a719106e31730460546256ddf0d78e16dd782235eec151
SSDEEP

1536:qWFK1s1NvkoMNH7NBnHPY/l6PlqPb5cgmZfBCE16OpUFKBesSy:qb4KNHvab5LmZBCE1HpUFKBesSy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72a3e0789ca73c0bffd6f881c1b30848_JaffaCakes118

Files

72a3e0789ca73c0bffd6f881c1b30848_JaffaCakes118
.dll windows:4 windows x86 arch:x86

64ebf0a362921a5b5c95dd3a939320a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHDeleteKeyW

msvcrt

??2@YAPAXI@Z
__CxxFrameHandler
memmove
ceil
_ftol
memset
memcpy
??3@YAXPAX@Z
strlen
strstr
strcpy
memcmp
_CxxThrowException
malloc
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcsncat
wcscat
_wcsnicmp
wcschr
_errno
sprintf
strncpy
strncmp
wcsncpy
wcsrchr
_except_handler3
free
mbstowcs
wcscpy
wcsstr
wcstombs
strchr
atoi
_strnicmp

kernel32

CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
InterlockedExchange
CancelIo
Sleep
lstrlenW
MultiByteToWideChar
lstrcpyW
ResumeThread
lstrcmpiA
DeleteFileW
DeleteFileA
ReadFile
GetFileSize
CreateFileW
lstrcatW
GetSystemDirectoryW
ReleaseMutex
OpenEventW
SetErrorMode
CreateMutexA
GetTickCount
SetUnhandledExceptionFilter
ExitProcess
FreeConsole
CopyFileW
GetProcAddress
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
SetEvent
GetLastError
CreateDirectoryW
GetFileAttributesW
CreateProcessW
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileW
lstrcmpW
LocalReAlloc
FindFirstFileW
LocalAlloc
RemoveDirectoryW
SetFilePointer
WriteFile
MoveFileW
GetModuleFileNameW
SetLastError
GetLocalTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
LocalSize
TerminateProcess
OpenProcess
GetCurrentProcess
lstrcmpiW
GetCurrentThreadId
WaitForSingleObject
TerminateThread
CloseHandle
CreateEventW
CreateFileMappingW
GetVersionExW

user32

IsWindow
CloseWindow
CreateWindowExW
OpenDesktopW
GetThreadDesktop
GetUserObjectInformationW
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
GetCursorInfo
GetCursorPos
ReleaseDC
GetDC
SetRect
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyW
keybd_event
SystemParametersInfoW
SendMessageW
BlockInput
DestroyCursor
LoadCursorW
MessageBoxW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
GetWindowTextA
GetClassNameA
GetWindow
PostMessageW
GetTopWindow
GetDesktopWindow
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CharNextW
GetWindowTextW
GetForegroundWindow
GetAsyncKeyState
GetKeyState
ExitWindowsEx
mouse_event

gdi32

SelectObject
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject

advapi32

ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExW
RegQueryValueW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
GetTokenInformation
LookupAccountSidW
RegEnumValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegSetValueExW
RegCreateKeyW
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
SetEntriesInAclW
RegCreateKeyExW
StartServiceW
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegDeleteKeyW

shell32

ShellExecuteW
SHGetFileInfoA

winmm

waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInAddBuffer
waveOutOpen
waveOutGetNumDevs
waveInStart
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutClose
waveOutReset

ws2_32

__WSAFDIsSet
setsockopt
recvfrom
sendto
listen
accept
getpeername
WSACleanup
WSAStartup
bind
inet_addr
getsockname
inet_ntoa
gethostname
send
select
closesocket
recv
ntohs
socket
gethostbyname
htons
WSAIoctl
connect

wininet

InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetGetConnectedState
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

avicap32

capCreateCaptureWindowW
capGetDriverDescriptionW

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrame
ICSeqCompressFrameStart

msvcp60

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z

psapi

EnumProcessModules
GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

Exports

Exports

End_DDDInfo
Get_DDDInfo
Run_DDDInfo
ServiceMain
aaa_DDDInfo
aaaa_DDDInfo
bbb_DDDInfo
bbbb_DDDInfo
ccc_DDDInfo
cccc_DDDInfo
dddd_DDDInfo
eee_DDDInfo
eeee_DDDInfo
fff_DDDInfo
ffff_DDDInfo
ggg_DDDInfo
gggg_DDDInfo
hhh_DDDInfo
hhhh_DDDInfo
iii_DDDInfo
kkk_DDDInfo
lll_DDDInfo
zzz_DDDInfo

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64ebf0a362921a5b5c95dd3a939320a4

Headers

File Characteristics

Imports

shlwapi

msvcrt

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

wininet

avicap32

msvfw32

msvcp60

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 11KB - Virtual size: 22KB

.rsrc Size: 1024B - Virtual size: 728B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 11KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 728B

.reloc
Size: 5KB - Virtual size: 5KB