891cdaf236719679df44b6c7d798dba2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

891cdaf236719679df44b6c7d798dba2_JaffaCakes118
Size

124KB
MD5

891cdaf236719679df44b6c7d798dba2
SHA1

a35de876585559890390acf37d3b00d935e9a8ee
SHA256

48ee16460eef196e04700aaf0f6474620eae3f97ebf142f59dfeb1ef785d2524
SHA512

2f87cbd1ba206bda1a0d9b6be890d356268d8ad65975f4c001c1158e43649c9e07b0cbe79df8d80c32287732e0a32ba5de65eb389a4eb7a2d105633fc373edbf
SSDEEP

3072:uOynh1yprCeTxY5pmSVB6/wbJ0oDAsqp807Zd:YOt8K+kwS8AsqR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
891cdaf236719679df44b6c7d798dba2_JaffaCakes118

Files

891cdaf236719679df44b6c7d798dba2_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

4fee907aa1ae0fa2005db25748119cd8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetSpecialFolderPathA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

gdi32

SelectObject
CreateCompatibleDC
DeleteObject
BitBlt
CreateFontA
GetObjectA
GetStockObject
SetBkMode
LineTo
MoveToEx
CreateSolidBrush

netapi32

Netbios

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wininet

HttpSendRequestA
InternetReadFile
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetGetConnectedState
InternetCrackUrlA
InternetCloseHandle

msvcrt

_except_handler3
??2@YAPAXI@Z
strchr
realloc
free
malloc
_snprintf
rand
srand
time
memcpy
strlen
memmove
sprintf
memset
__CxxFrameHandler
memcmp
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
_CxxThrowException
_fullpath
strcat
_mbsstr
_endthreadex
strstr
_itoa
isalnum
fgets
fseek
sscanf
fopen
fputs
fclose
strcpy
_access
localtime
strftime
atoi
strcmp
_beginthreadex
_mbsicmp
strrchr
strncpy
_vsnprintf
_mbscmp
mbstowcs
_purecall
_ftol
??3@YAXPAX@Z

shlwapi

StrStrA
PathFindFileNameA
PathStripToRootA
SHDeleteKeyA
SHSetValueA
PathAddExtensionA
PathCombineA
PathRemoveFileSpecA
StrChrA
PathRemoveExtensionA
PathFindExtensionA
StrStrIA
StrRChrA
StrTrimA
StrCmpNIA
PathRemoveBackslashA
PathAddBackslashA
SHGetValueA
SHDeleteValueA

kernel32

LocalAlloc
SetFileAttributesA
DeleteCriticalSection
LocalFree
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetExitCodeThread
TerminateThread
CreateThread
GetTempPathA
CreateProcessA
CreateEventA
SetEvent
ReleaseMutex
FreeLibrary
LoadLibraryA
GetProcAddress
DeviceIoControl
WaitForSingleObject
GetFileSize
SetFilePointer
FlushFileBuffers
SetEndOfFile
SystemTimeToFileTime
FindClose
RemoveDirectoryA
CreateDirectoryA
GetShortPathNameA
GetTempFileNameA
MoveFileExA
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetPrivateProfileIntA
WritePrivateProfileStringA
MoveFileA
GetFileTime
FileTimeToSystemTime
CopyFileA
Sleep
RaiseException
GetLocalTime
GetTickCount
GetSystemDirectoryA
DeleteFileA
CreateMutexA
GetLastError
InitializeCriticalSection
DisableThreadLibraryCalls
GetCommandLineA
GetModuleFileNameA
GetVersionExA
lstrcpynA
VirtualProtect
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetPrivateProfileStringA
CreateFileA
WriteFile
CloseHandle
GetWindowsDirectoryA
lstrcatA
FindFirstFileA
lstrcmpA
FindNextFileA
lstrcpyA
GetFileAttributesA
InterlockedDecrement
WideCharToMultiByte
lstrlenW
lstrcmpiA
lstrlenA
MultiByteToWideChar

user32

SetWindowPos
MapWindowPoints
GetClientRect
GetDlgItem
GetWindowLongA
GetWindowRect
GetWindow
GetParent
SetWindowTextA
GetWindowTextA
CheckDlgButton
GetDlgItemInt
SetDlgItemInt
DialogBoxParamA
EndDialog
SendMessageA
SetWindowLongA
DestroyWindow
KillTimer
SetTimer
GetCursorPos
IsWindowVisible
GetClassNameA
EnumChildWindows
ReleaseDC
LoadBitmapA
GetDC
DefWindowProcA
IsWindow
ScreenToClient
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadStringA
FindWindowA
PostQuitMessage
GetClassInfoExA
DispatchMessageA
TranslateMessage
GetMessageA
CloseDesktop
CloseWindowStation
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
DrawTextA
OffsetRect
SetRect
SetDlgItemTextA
FillRect
EndPaint
BeginPaint
InvalidateRect
GetDlgItemTextA
ShowWindow
SetForegroundWindow
GetActiveWindow
IsDialogMessageA
IsDlgButtonChecked
MessageBoxA
SystemParametersInfoA

ole32

CoCreateInstance
CoInitialize
CLSIDFromString
CoGetMalloc
StringFromIID
CoUninitialize

oleaut32

SysStringLen
SysAllocString
SysFreeString

ws2_32

WSAStartup
WSACleanup
gethostbyname
htons
closesocket
select
connect
ioctlsocket
socket
send
recv

comctl32

ImageList_Create
ImageList_Destroy
ImageList_AddMasked

setupapi

SetupIterateCabinetA

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Service
Uninstall

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vision
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4fee907aa1ae0fa2005db25748119cd8

Headers

File Characteristics

Imports

shell32

comdlg32

gdi32

netapi32

version

wininet

msvcrt

shlwapi

kernel32

user32

ole32

oleaut32

ws2_32

comctl32

setupapi

urlmon

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 8KB - Virtual size: 17KB

.vision Size: 4KB - Virtual size: 4B

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 8KB - Virtual size: 17KB

.vision
Size: 4KB - Virtual size: 4B

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 8KB - Virtual size: 6KB