82166a9aca9547a9eb1a6c99881223da_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

82166a9aca9547a9eb1a6c99881223da_JaffaCakes118
Size

117KB
MD5

82166a9aca9547a9eb1a6c99881223da
SHA1

d9ae69e481c7af9c714bf30bdc198b9caafa7401
SHA256

47bcaa8e113ec6ba530fd132bd9b7100eb5c7f628064f16627e38cf7296101c1
SHA512

abcfe96629946c022826eff62017676100f2369f3eaa628f2c8ea2e50150512adadcab2682f4866a19ab3d8505a6136a9fc646f8c6ffcf0af0eee748b99062f0
SSDEEP

3072:qyLVNn1emMDu4rwurBk+3KFASO1BH8BxC8e:tvn1GFrD6FASO1h8BxC8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82166a9aca9547a9eb1a6c99881223da_JaffaCakes118

Files

82166a9aca9547a9eb1a6c99881223da_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

65c4a7fee819d1de43b92ce8c357795c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

o:\OOO320\src\extensions\wntmsci12.pro\bin\so_activex.pdb

Imports

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegDeleteKeyExA
RegEnumKeyA
RegEnumKeyExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateOleAdviseHolder
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
WriteClassStm
OleSaveToStream
CoCreateInstance
CreateBindCtx

oleaut32

SysStringByteLen
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayLock
SafeArrayUnlock
SafeArrayCreateVector
SafeArrayPutElement
SysAllocStringByteLen
VariantCopy
OleCreatePropertyFrame
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysAllocString
SysStringLen
VariantChangeType
VariantClear
SysFreeString

gdi32

LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateDCA
GetDeviceCaps
CreateRectRgnIndirect

urlmon

CreateURLMoniker
RegisterBindStatusCallback

msvcr90

??2@YAPAXI@Z
_purecall
_recalloc
strncmp
memmove_s
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
sprintf
??_U@YAPAXI@Z
_resetstkoflw
memset
sprintf_s
??_V@YAXPAX@Z
memcpy_s
free
malloc
strstr
??3@YAXPAX@Z
strncpy_s
_wcsdup

kernel32

VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
FormatMessageA
LocalFree
MulDiv
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
SetLastError
IsDBCSLeadByte
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
InterlockedExchange
Sleep
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
DisableThreadLibraryCalls
GetCurrentProcess
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar

user32

UnregisterClassA
RegisterClassA
GetWindowRect
FillRect
MessageBoxA
GetDC
ReleaseDC
UpdateWindow
CreateWindowExA
RegisterClassExA
GetKeyState
InvalidateRect
IsWindow
CharNextA
wsprintfA
SetWindowLongA
GetWindowLongA
ShowWindow
GetClassInfoExA
LoadCursorA
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
EndPaint
GetClientRect
BeginPaint
CallWindowProcA
PtInRect
UnionRect
DefWindowProcA
SetFocus
IsChild
GetFocus
GetParent
DestroyWindow

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRegisterServerDoc
DllRegisterServerNative
DllUnregisterServer
DllUnregisterServerDoc
DllUnregisterServerNative

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65c4a7fee819d1de43b92ce8c357795c

Headers

File Characteristics

PDB Paths

Imports

advapi32

ole32

oleaut32

gdi32

urlmon

msvcr90

kernel32

user32

Exports

Exports

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 5KB - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 6KB - Virtual size: 6KB