96e398ab84d842b289ce196eaf00a1e1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

96e398ab84d842b289ce196eaf00a1e1_JaffaCakes118
Size

60KB
MD5

96e398ab84d842b289ce196eaf00a1e1
SHA1

18b2ca0d00061bb869dda3f8b95a578d51a912fe
SHA256

42402a58b0c0e397aa8ff9f0f393c6424b1fe2ada32af8f6717f93de4619fe10
SHA512

7e8cf44f50eae0c82d2d91489fc7ed4b9547b77dd693e61f0f277c5ec16ba6efc71314b875dadf2ffaa8ee8a786c0cfa13850d0900fd2b5959bf055f62e70009
SSDEEP

768:FlVu1A1nCwErj+cTRVT+AJQyf9A+Q+r7qwh0kQHQi:F2u1C76YT+KlAqqwh0kQHQi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96e398ab84d842b289ce196eaf00a1e1_JaffaCakes118

Files

96e398ab84d842b289ce196eaf00a1e1_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

02e50efe6459846b11a005300e187ac3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalLock
Sleep
CreateProcessA
OpenMutexA
GetModuleFileNameA
CreateThread
WideCharToMultiByte
GetLastError
GetVersion
LocalFree
OutputDebugStringA
GetTickCount
FindClose
lstrcpyA
GetWindowsDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
GetExitCodeThread
GetTimeFormatA
GetDateFormatA
GetPrivateProfileStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
lstrcatA
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalUnlock
CreateEventA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
lstrcpynW
lstrcpynA
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetEvent
WaitForSingleObject
ResetEvent
CloseHandle
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
FindFirstFileA
InitializeCriticalSection

user32

MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
FindWindowA
SendMessageA
DispatchMessageA
SetForegroundWindow
LoadStringA
InsertMenuA
LoadBitmapA
SetMenuItemBitmaps
BringWindowToTop

advapi32

RegQueryValueExA
AllocateAndInitializeSid
GetSecurityInfo
FreeSid
SetFileSecurityA
SetSecurityDescriptorDacl
RegSetValueExA
RegOpenKeyExA
SetSecurityInfo
RegCloseKey
SetEntriesInAclA
InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathA
DragQueryFileA

ole32

ReleaseStgMedium
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
VariantInit

atl71

ord64
ord22
ord18
ord23
ord61
ord32
ord58
ord31
ord15

msvcp71

?_Nomemory@std@@YAXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr71

_mkdir
__CppXcptFilter
_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__security_error_handler
_onexit
__dllonexit
_callnewh
memset
fopen
fgets
fclose
rand
memmove
_ismbcspace
_mbsinc
_except_handler3
free
??3@YAXPAX@Z
_mbsrchr
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_purecall
??_V@YAXPAX@Z
malloc
_resetstkoflw

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02e50efe6459846b11a005300e187ac3

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl71

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 560B

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 560B

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 3KB