97449029eaa7a8fd1fa85b1e5d104849_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

97449029eaa7a8fd1fa85b1e5d104849_JaffaCakes118
Size

340KB
MD5

97449029eaa7a8fd1fa85b1e5d104849
SHA1

f6580055756cfc89f5a093cdbdc8678089024547
SHA256

22950ebf9f826b080bd589ce8b540f06c2773ed5cff3fb4958f385c7577b9afb
SHA512

6872db086d14a96eb994b8752558836b19db8a59bb83c882bdb5d95c1a607daf282080731eb7e1fc2aadd19b144b4386ad86a1e157a9c922059fae7ee54bd64a
SSDEEP

6144:SSX4SZuD9OXuAAq0kSFVtzQSf9MTr/sgh2T+go+jzoYbuomzyqydf:OSED9ODp01MTbHk+goYzTbnN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97449029eaa7a8fd1fa85b1e5d104849_JaffaCakes118

Files

97449029eaa7a8fd1fa85b1e5d104849_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

444fced704b765e8ddafc8991f235527

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

scrrun.pdb

Imports

msvcrt

_write
_lseeki64
_fileno
__pioinfo
__badioinfo
wctomb
_snprintf
isleadbyte
_isatty
_onexit
_lock
__dllonexit
_unlock
_adjust_fdiv
free
_initterm
_XcptFilter
_iob
_vsnwprintf
_errno
_wcsnicmp
towlower
_itow
_wcsicmp
towupper
iswalpha
_mbctolower
_itoa
_mbctoupper
_ismbblead
_mbsdec
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_vsnprintf
memcpy
memmove
malloc
_amsg_exit
wcsncmp
bsearch
_mbsnbicmp
_mbsicmp
isalpha
srand
rand
memset

oleaut32

VarDecFromI4
SysFreeString
SysAllocStringLen
UnRegisterTypeLi
SysStringLen
LoadRegTypeLi
VariantCopy
VariantClear
LHashValOfNameSys
LHashValOfNameSysA
VarCyFromR8
VariantChangeTypeEx
SysAllocString
LoadTypeLi
SysReAllocStringLen
VarCyFromI4
SafeArrayUnlock
VarR4FromDec
VarCyFromR4
VarR4FromCy
SafeArrayDestroy
SafeArrayCreate
SafeArrayLock
LoadTypeLibEx

ole32

StringFromCLSID
StringFromGUID2
CoGetMalloc
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree

advapi32

RegOpenKeyExA
RegQueryValueA
RegQueryInfoKeyA
RegEnumKeyA
RegQueryValueExA
RegSetValueA
RegSetValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
IsTextUnicode

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
VirtualAlloc
MoveFileW
RemoveDirectoryW
GetShortPathNameW
VirtualProtect
FindNextFileW
GetSystemDirectoryW
GetWindowsDirectoryW
GetTempPathW
CopyFileW
DeleteFileW
GetFileAttributesW
CreateDirectoryA
MoveFileA
RemoveDirectoryA
GetShortPathNameA
GetFullPathNameA
FindNextFileA
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
CopyFileA
DeleteFileA
GetStdHandle
InterlockedDecrement
InterlockedIncrement
SetFileAttributesW
SetFileAttributesA
GetVersion
GetLocaleInfoA
LoadLibraryExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetVersionExA
LoadLibraryA
GetUserDefaultLangID
GetProcAddress
GetModuleFileNameW
GetTickCount
GetConsoleMode
GetFileInformationByHandle
SetFilePointer
WriteConsoleW
WriteFile
PeekNamedPipe
ReadFile
CloseHandle
CreateFileW
CreateFileA
FindFirstFileW
FindFirstFileA
FindClose
GetLogicalDrives
SetVolumeLabelW
SetVolumeLabelA
SetErrorMode
GetVolumeInformationW
GetVolumeInformationA
GetDiskFreeSpaceW
GetLastError
GetDiskFreeSpaceA
GetDriveTypeW
GetDriveTypeA
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadResource
FindResourceExW
LoadLibraryExW
MapViewOfFile
CreateFileMappingW
GetLocaleInfoW
GetVersionExW
UnmapViewOfFile
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
FindResourceW
GetFileAttributesA
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
LCMapStringA
SearchPathW
SetLastError
CompareStringW
CompareStringA

user32

CharNextA
LoadStringA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Exports

Exports

ServiceMain
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoOpenPipeStream

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

444fced704b765e8ddafc8991f235527

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

ole32

advapi32

kernel32

user32

version

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 204KB - Virtual size: 200KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 120KB - Virtual size: 117KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 204KB - Virtual size: 200KB

.reloc
Size: 8KB - Virtual size: 5KB