8bb22beae3290eaa1dae09c3bbf965c3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8bb22beae3290eaa1dae09c3bbf965c3_JaffaCakes118
Size

612KB
MD5

8bb22beae3290eaa1dae09c3bbf965c3
SHA1

b23dd52c9a7143f3765d26e67b66a4ba3d856da9
SHA256

96fac77271d257708a6b93288d8491b9e2b425bd426ca3dd4f1c01f68ae7e043
SHA512

582b6d4267cb36833b2dcaafb9b9f074a0a37816bbc21fcd14287cd1271bfb98ec2f3867633ffa96ab0fca528a99134194d5e73b8a7e373cf1df5531943e3cc4
SSDEEP

6144:uHrg8F6aSn59Fw32NJLUjmYld9cPRIHtvsdM6SHwFnraKLDABv3jgh5n+3jSDzsq:uH9xSnDFcS0m8ds+4fMvzSnwwzs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bb22beae3290eaa1dae09c3bbf965c3_JaffaCakes118

Files

8bb22beae3290eaa1dae09c3bbf965c3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

da1943b598d950933d3bbf60ce2c6cd0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHCreateShellPalette
SHCreateStreamOnFileA
SHCreateStreamOnFileW
ord16
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHStrDupA
SHSkipJunction
SHSetValueW
SHSetValueA
SHSetThreadRef
SHRegWriteUSValueW
SHRegWriteUSValueA
SHRegSetUSValueW
SHRegSetUSValueA
SHRegSetPathW
SHRegSetPathA
SHRegQueryUSValueW
SHRegQueryUSValueA
SHRegQueryInfoUSKeyW
SHCopyKeyW
SHRegOpenUSKeyW
SHRegOpenUSKeyA
SHRegGetUSValueW
SHRegGetUSValueA
SHRegGetPathW
SHRegGetPathA
SHRegGetBoolUSValueW
SHRegGetBoolUSValueA
SHRegEnumUSValueW
SHRegEnumUSValueA
SHRegEnumUSKeyW
SHRegEnumUSKeyA
SHRegDuplicateHKey
SHRegDeleteUSValueW
SHRegDeleteUSValueA
SHRegDeleteEmptyUSKeyW
SHRegDeleteEmptyUSKeyA
SHRegCreateUSKeyW
SHRegCreateUSKeyA
SHEnumValueW
SHGetInverseCMAP
SHGetThreadRef
SHGetValueA
SHGetValueW
SHIsLowMemoryMachine
SHRegCloseUSKey
SHQueryValueExW
SHCopyKeyA
SHRegQueryInfoUSKeyA
SHQueryValueExA
SHQueryInfoKeyW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHStrDupW

kernel32

CreateEventW
FindFirstChangeNotificationW
ResumeThread
SetThreadPriority
CreateThread
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
OpenEventW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcess
GetCommandLineA
HeapFree
FindNextChangeNotification
HeapAlloc
GetProcessHeap
GetStartupInfoA
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
WaitForMultipleObjects
Sleep
CloseHandle
FindCloseChangeNotification
GetVersionExA
SetProcessShutdownParameters
GetConsoleCursorInfo
lstrlenW
ExpandEnvironmentStringsW
LocalAlloc
SetEvent
LocalReAlloc
FindClose
FindNextFileW
CompareStringW
lstrcmpiW
GetLastError
FindFirstFileW
LeaveCriticalSection
EnterCriticalSection
ExitThread
Beep
SetUnhandledExceptionFilter
LocalFree
FlushFileBuffers
GetSystemInfo
VirtualProtect
GetLocaleInfoA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
HeapReAlloc
VirtualAlloc
GetCPInfo
GetOEMCP
GetACP
LoadLibraryA
VirtualQuery
InterlockedExchange
RtlUnwind
GetEnvironmentVariableW

ole32

CoInitialize

user32

SetWindowPos
GetDesktopWindow
GetParent
LoadStringW
SetForegroundWindow
CheckDlgButton
SendMessageW
GetClientRect
GetDlgItem
EndDialog
PostMessageW
IsDlgButtonChecked
SendDlgItemMessageW
SetDlgItemTextW
DestroyIcon
GetWindowRect
SetTimer
LoadImageW
DialogBoxParamW
MessageBoxW
DefWindowProcW
LoadIconW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassW
GetWindowLongW
GetSystemMetrics
KillTimer

advapi32

RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW
GetAce
RegOpenKeyExW

msvcrt

memset

shell32

SHGetFileInfoW
Shell_NotifyIconW

winmm

mmioRead

setupapi

CM_Request_Eject_PC
CM_Request_Device_Eject_ExW
CM_Request_Device_Eject_ExA
CM_Request_Device_EjectW
CM_Request_Device_EjectA
CM_Remove_SubTree_Ex
CM_Remove_SubTree
CM_Register_Device_Interface_ExW
CM_Register_Device_Interface_ExA
CM_Register_Device_InterfaceW
CM_Register_Device_InterfaceA
CM_Register_Device_Driver_Ex
CM_Register_Device_Driver
CM_Reenumerate_DevNode_Ex
CM_Reenumerate_DevNode
CM_Query_Resource_Conflict_List
CM_Query_Remove_SubTree_Ex
CM_Query_Remove_SubTree
CM_Query_Arbitrator_Free_Size_Ex
CM_Query_Arbitrator_Free_Size
CM_Query_Arbitrator_Free_Data_Ex
CM_Query_Arbitrator_Free_Data
CM_Query_And_Remove_SubTree_ExW
CM_Query_And_Remove_SubTree_ExA
CM_Query_And_Remove_SubTreeW
CM_Query_And_Remove_SubTreeA
CM_Open_DevNode_Key_Ex
CM_Open_DevNode_Key
CM_Open_Class_Key_ExW
CM_Open_Class_Key_ExA
CM_Open_Class_KeyW
CM_Open_Class_KeyA
CM_Next_Range
CM_Move_DevNode_Ex
CM_Move_DevNode
CM_Modify_Res_Des_Ex
CM_Modify_Res_Des
CM_Merge_Range_List
CM_Locate_DevNode_ExW
CM_Locate_DevNode_ExA
CM_Locate_DevNodeW
CM_Locate_DevNodeA
CM_Request_Eject_PC_Ex

Exports

Exports

zsvncafv

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 556KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1B

IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1B

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1B

IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1B

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1B

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da1943b598d950933d3bbf60ce2c6cd0

Headers

File Characteristics

Imports

shlwapi

kernel32

ole32

user32

advapi32

msvcrt

shell32

winmm

setupapi

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 556KB - Virtual size: 644KB

.reloc Size: 4KB - Virtual size: 1B

.rdata Size: 4KB - Virtual size: 1B

.rsrc Size: 4KB - Virtual size: 1B

.reloc Size: 4KB - Virtual size: 1B

.rsrc Size: 4KB - Virtual size: 1B

.rsrc Size: 4KB - Virtual size: 800B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 556KB - Virtual size: 644KB

.reloc
Size: 4KB - Virtual size: 1B

.rdata
Size: 4KB - Virtual size: 1B

.rsrc
Size: 4KB - Virtual size: 1B

.reloc
Size: 4KB - Virtual size: 1B

.rsrc
Size: 4KB - Virtual size: 1B

.rsrc
Size: 4KB - Virtual size: 800B

.reloc
Size: 4KB - Virtual size: 2KB