8640a9a55828a6f620845a07c3a184e6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8640a9a55828a6f620845a07c3a184e6_JaffaCakes118
Size

196KB
MD5

8640a9a55828a6f620845a07c3a184e6
SHA1

883887e2d80b7942a85072a086c8b7ed3d3dee3b
SHA256

ce9a7413309a1ddd7a39d03e5fd056a17919b7b0bd897293c159e9c7f85440e9
SHA512

65a294261f2ee3334c40705197b86b3fe3c7369cf9d1d48df25eefedbaa9b3f2cd9f621550dd0a344deefdef4da69a9a5254f25f8d9c07570b148bbe554a11ca
SSDEEP

1536:nwRazXnqj2EoK5e+yUASaQljPv00znxM:nVbqaEoKg+yUhzl4Gx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8640a9a55828a6f620845a07c3a184e6_JaffaCakes118

Files

8640a9a55828a6f620845a07c3a184e6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9f13512e2a7716a657a456d814dfa1ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
CreateThread
WideCharToMultiByte
lstrlenW
Sleep
GetTickCount
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
lstrlenA
GetTempPathA
CloseHandle
GetModuleHandleA
OpenProcess
GetModuleFileNameA
CopyFileA
SetFileAttributesA
GetComputerNameA
TerminateProcess
Process32Next
CreateToolhelp32Snapshot
OutputDebugStringA

user32

CallNextHookEx
GetKeyState
GetAsyncKeyState
GetWindowLongA
MessageBoxA
SetWindowsHookExA
GetKeyboardState
ToAscii
GetWindowTextA
RegisterWindowMessageA
SendMessageTimeoutA
GetClassNameA
GetWindowThreadProcessId
wsprintfA
GetForegroundWindow
EnumChildWindows

ole32

CoInitialize

oleaut32

VariantClear
SysFreeString

msvcp60

??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

msvcrt

strncmp
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
free
_vsnprintf
fseek
fread
sscanf
strncpy
_stricmp
_splitpath
printf
rand
fwrite
atoi
fopen
_mbscmp
__CxxFrameHandler
wcslen
??2@YAPAXI@Z
_purecall
_strlwr
memmove
sprintf
fclose

mpr

WNetAddConnection2A
WNetCancelConnection2A

netapi32

NetRemoteTOD
NetApiBufferFree
NetScheduleJobAdd

ws2_32

gethostbyname
gethostname
inet_ntoa

shlwapi

PathStripPathA

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetReadFile
HttpSendRequestA
HttpAddRequestHeadersA

Exports

Exports

??_C@_06GDGJ@IeInfo?$AA@
??_C@_09KCFI@XiaoXiao3?$AA@
??_C@_0BA@DDLJ@?W?i?$LM?$PO?$CFs?$LE?$LE?$LN?$KI?J?$KH?$LA?$NM?$CB?$AA@
??_C@_0BC@KMAM@?W?i?$LM?$PO?$CFs?$LD?u?J?$LM?$LL?$KP?J?$KH?$LA?$NM?$CB?$AA@
??_C@_0O@CJBP@?U?R?$LC?$LL?$LF?$LN?W?i?$LM?$PO?$CFs?$CB?$AA@
DllCreatePinboardInstance
__NewIeInfo
__NewXiaoXiao3

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xia__ox_
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f13512e2a7716a657a456d814dfa1ea

Headers

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

msvcp60

msvcrt

mpr

netapi32

ws2_32

shlwapi

wininet

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 1KB

xia__ox_ Size: 140KB - Virtual size: 139KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 1KB

xia__ox_
Size: 140KB - Virtual size: 139KB

.reloc
Size: 4KB - Virtual size: 3KB