8da8241929b448c13e68200c17a9b863_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8da8241929b448c13e68200c17a9b863_JaffaCakes118
Size

4.5MB
MD5

8da8241929b448c13e68200c17a9b863
SHA1

d7ece707d0754dec2918f8449bc693c75d9fc9cc
SHA256

5159eb6da27c7174397d70516e256279b956f2d6cc84a0e7dbb7660df249e833
SHA512

0ab75be0d2a7d14cb9891ecf5be75feac9f501f3537b7274d92211cf9390a7d1e8b65c41831220e1a3abf55c9bf8452d4b889ab6b609628f97b0aac4c39d0f76
SSDEEP

49152:Ebz4XC/m3Cp653vbPA5QsGDRmlUI4WmCw4hWGlK+rImZxnKbBjgYyjMrqvNP7FaD:JTBPA5QsAhJT4VXrImZNKb1yjMCq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8da8241929b448c13e68200c17a9b863_JaffaCakes118

Files

8da8241929b448c13e68200c17a9b863_JaffaCakes118
.dll windows:4 windows x86 arch:x86

057afa34b6cf03dcb4ec800c004f209c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

__WSAFDIsSet
closesocket
socket
WSAAsyncSelect
WSASetLastError
getservbyport
gethostbyaddr
getservbyname
ioctlsocket
ntohl
select
WSAGetLastError
ntohs
shutdown
setsockopt
getsockopt
gethostname
inet_ntoa
connect
inet_addr
gethostbyname
send
WSAStartup
htonl
htons
recv
accept

user32

MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
SetWindowLongW
GetDC
ReleaseDC
InvalidateRect
MessageBoxW
SendNotifyMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjectsEx
DestroyWindow
PeekMessageW
PostMessageW
RegisterClassW
CreateWindowExW
DefWindowProcW
KillTimer
SetTimer
FillRect
DrawTextExW
GetWindowLongW

advapi32

MapGenericMask
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
AccessCheck
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
RegNotifyChangeKeyValue
QueryServiceConfigW
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
ImpersonateSelf
GetFileSecurityW
OpenThreadToken

gdi32

CloseFigure
StrokePath
ExtCreatePen
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectObject
EndPath
StretchDIBits
PolyBezierTo
FillPath
GetStockObject
CreateSolidBrush
GetDIBits
GetObjectA
DeleteObject
BeginPath

shell32

SHGetFileInfoA
CommandLineToArgvW
SHGetFileInfoW
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
SHGetDesktopFolder
SHGetMalloc
SHGetFolderLocation
SHFileOperationW
ShellExecuteExW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

extendscript

?exit@InitTerm@ScScript@@SAXXZ
?init@InitTerm@ScScript@@SAXXZ
?createEngine@Engine@ScScript@@SAPAV12@W4Type@12@@Z
?getClassInfo@Dispatcher@ScScript@@UAEPBVClassInfo@ScCore@@ABVString@4@@Z
?getEnumerableProperties@Dispatcher@ScScript@@UBEXABVVariant@ScCore@@AAVSimpleArray@4@J@Z
?getProperties@Dispatcher@ScScript@@UBEXJJAAV?$TSimpleArray@$$CBVPropInfo@ScScript@@@ScCore@@@Z
?call@Dispatcher@ScScript@@UAEXAAUArguments@2@P6AX0@Z@Z
?put@Dispatcher@ScScript@@UAEXAAUArguments@2@@Z
?get@Dispatcher@ScScript@@UAEXAAUArguments@2@@Z
?getEnumNames@Dispatcher@ScScript@@UBEXABVVariant@ScCore@@AAV?$TSimpleArray@VString@ScCore@@@4@@Z
?hasProperty@Dispatcher@ScScript@@UBEPBUPropEntry@2@ABVVariant@ScCore@@0_N@Z
?findProperty@Dispatcher@ScScript@@UBEPBVPropInfo@2@JJPAVRoot@ScCore@@_N1@Z
??0Dispatcher@ScScript@@QAE@PBD@Z
?addClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z
?registerProperties@Dispatcher@ScScript@@QAEXJPBUPropEntry@2@@Z
??1Dispatcher@ScScript@@UAE@XZ

sccore

?match@RegExp@ScCore@@QBE_NABVString@2@JAAVCapture@2@@Z
??1String@ScCore@@QAE@XZ
??0RegExp@ScCore@@QAE@ABVString@1@J@Z
??0String@ScCore@@QAE@PBGH@Z
?setBool@Variant@ScCore@@QAEX_N@Z
?doToString@Variant@ScCore@@IBEXH@Z
??AArray@ScCore@@QBEABVVariant@1@K@Z
?setDouble@Variant@ScCore@@QAEXN@Z
??3Heap@ScCore@@SAXPAX@Z
??2Heap@ScCore@@SAPAXI@Z
?init@InitTerm@ScCore@@SAXXZ
?exit@InitTerm@ScCore@@SAXXZ
?setString@Variant@ScCore@@QAEXPBG@Z
??1Variant@ScCore@@QAE@XZ
??1RegExp@ScCore@@QAE@XZ

bib

ord5

kernel32

GlobalMemoryStatus
FindFirstFileA
CreateFileA
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetConsoleMode
UnhandledExceptionFilter
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetStringTypeW
GetStringTypeA
HeapCreate
ReadConsoleInputA
SetConsoleMode
SetLastError
GetFileType
GetVersion
CreateProcessA
GetSystemDirectoryW
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
LCMapStringW
LocalReAlloc
LocalAlloc
HeapDestroy
GetOEMCP
GetACP
GetDriveTypeA
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
ExitProcess
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
GetCPInfo
LCMapStringA
HeapSize
GetCurrentDirectoryA
FlushConsoleInputBuffer
GetSystemDirectoryA
GetCommandLineW
FreeEnvironmentStringsW
GetCurrentProcess
VirtualFree
VirtualAlloc
GetThreadPriority
SetThreadPriority
CreateProcessW
SetStdHandle
GetStdHandle
RemoveDirectoryW
GetTickCount
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
CloseHandle
CreateThread
FindFirstFileW
SetFilePointer
GetDriveTypeW
SetEndOfFile
HeapAlloc
MoveFileExW
HeapFree
CreateDirectoryW
GetCurrentThread
GetProcessHeap
SetFileTime
WriteFile
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
GetFileSizeEx
GetLastError
SetVolumeLabelW
FindClose
GetFileTime
DeleteFileW
SetFileAttributesW
GetFullPathNameA
GetTempPathW
GetLongPathNameW
FindNextFileW
FindFirstChangeNotificationW
WaitForSingleObject
FindCloseChangeNotification
SetErrorMode
Process32First
Sleep
Process32Next
CreateToolhelp32Snapshot
GetCurrentProcessId
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
FormatMessageW
LocalFree
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
FormatMessageA
InitializeCriticalSection
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
GetModuleHandleA
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetCurrentThreadId
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
LoadLibraryA
GetModuleFileNameA
FatalAppExitA
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
WaitNamedPipeW
OpenProcess
GetConsoleWindow
GetExitCodeProcess
TerminateProcess
DuplicateHandle
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetNamedPipeInfo
GetOverlappedResult
FlushFileBuffers
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetEnvironmentVariableW
SetEnvironmentVariableW
GetEnvironmentStringsW

Exports

Exports

??6@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV01@ABVAWS_CS_MultiString_Internal@@@Z
?CommonSymbolsVersion@@YAIXZ
ARMGetVersion
ARMInitialize
ARMTerminate
CommonSymbolsInitialize
CommonSymbolsTerminate
WebAccessFlushAuthHeaders
WebAccessFlushAuthHeadersForRealmExtension
WebAccessFlushAuthHeadersForServer
WebAccessHttpCreateInstance
WebAccessHttpInitialize
WebAccessHttpNetPump
WebAccessHttpTerminate
WebAccessHttpVersion
WebAccessUtilsAddAuthentication
WebAccessUtilsClearAuthenticationCache
WebAccessUtilsFindAuthentication
WebAccessUtilsGetAuthentication_Internal
WebAccessUtilsGoToURL
WebAccessUtilsInitialize
WebAccessUtilsRemoveAuthentication
WebAccessUtilsTerminate
WebAccessUtilsUserLoginDialog_Internal

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 788KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

057afa34b6cf03dcb4ec800c004f209c

Headers

File Characteristics

Imports

ws2_32

user32

advapi32

gdi32

shell32

ole32

rpcrt4

extendscript

sccore

bib

kernel32

Exports

Exports

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 792KB - Virtual size: 788KB

.data Size: 100KB - Virtual size: 137KB

.tls Size: 4KB - Virtual size: 2B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 260KB - Virtual size: 257KB

.text Size: 132KB - Virtual size: 132KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 792KB - Virtual size: 788KB

.data
Size: 100KB - Virtual size: 137KB

.tls
Size: 4KB - Virtual size: 2B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 260KB - Virtual size: 257KB

.text
Size: 132KB - Virtual size: 132KB