72eb1c4b987e7df005bd3a306217f907_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

72eb1c4b987e7df005bd3a306217f907_JaffaCakes118
Size

112KB
MD5

72eb1c4b987e7df005bd3a306217f907
SHA1

19b42b9e48a4e37db0d3756157aac2aea26fe29e
SHA256

53990e2c241061eea75a7ead9fcf97ee9e38afb50f998923db83b9cb67b1d55a
SHA512

cf9f19b43fb90859fa49625163d0e46840727a9d187c22ec3ce8e53517b9e946c30d89fb989e8c67fe727a2d79ac4827c8c04a752a5b07105ccef1c7ed2e6768
SSDEEP

3072:XHfo5U+I+E1jOkMHwjIWjUr5NADxcl/tU:XQm+QjFgF8y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72eb1c4b987e7df005bd3a306217f907_JaffaCakes118

Files

72eb1c4b987e7df005bd3a306217f907_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

b6848a1c958c04daadf1a6803662c060

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle

kernel32

WriteFile
DeleteFileA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
lstrcmpiA
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcpynA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
CreateProcessA
GetCurrentThreadId
SetLastError
LockResource
MulDiv
GlobalUnlock
GlobalLock
lstrcmpA
GlobalFree
GlobalHandle
CreateDirectoryA
CreateThread
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetCommandLineA
GetFileAttributesA
HeapReAlloc
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
IsBadReadPtr
IsBadCodePtr
GetSystemTimeAsFileTime
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
LoadLibraryA
FlushFileBuffers
CloseHandle
CreateFileA
lstrcpyA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetACP
GetLocaleInfoA
InterlockedExchange
LCMapStringA
LCMapStringW
UnhandledExceptionFilter

user32

CreateWindowExA
wsprintfA
GetClassInfoExA
RegisterClassExA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
RegisterWindowMessageA
CreateDialogIndirectParamA
SetWindowContextHelpId
MapDialogRect
MessageBoxA
CreateAcceleratorTableA
GetParent
GetClassNameA
SetWindowPos
RedrawWindow
DestroyAcceleratorTable
GetDlgItem
IsWindow
SendMessageA
GetFocus
IsChild
GetWindow
SetFocus
CallWindowProcA
GetDesktopWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
FillRect
SetCapture
ReleaseCapture
GetSysColor
BeginPaint
GetClientRect
EndPaint
SendDlgItemMessageA
PostMessageA
DestroyWindow
DefWindowProcA
ShowWindow
GetWindowLongA
SetWindowLongA
CharNextA
UnregisterClassA
LoadCursorA

gdi32

GetStockObject
GetObjectA
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
CreateSolidBrush

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA

ole32

StringFromGUID2
CoCreateInstance
OleLockRunning
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
OleUninitialize
CoTaskMemRealloc

oleaut32

LoadTypeLi
UnRegisterTypeLi
SysAllocString
OleLoadPicture
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysAllocStringLen
SysStringLen
LoadRegTypeLi
VarUI4FromStr
SysFreeString
RegisterTypeLi

shlwapi

StrStrIA
PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6848a1c958c04daadf1a6803662c060

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 8KB - Virtual size: 7KB