a4596bf49d61fc62326d0896e364289d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a4596bf49d61fc62326d0896e364289d_JaffaCakes118
Size

892KB
MD5

a4596bf49d61fc62326d0896e364289d
SHA1

1df4012d8f736a71be8be02dac7e5e4d6a11217d
SHA256

30db90553d0892eae704c97ca915bf016efb4565c0ad01afbe7013a66d92cabd
SHA512

e56450bbda82b16daa910678ec1d85a12d519df92d0d5e90d6a1f4e96f9a482a1408ad743c1b521344bf43bbc28a8b2c1799c7e7980513c50a63f25faebd51c5
SSDEEP

24576:8xSQBfHXipgpij4umh7rF3o3t70fACNw:T8fipgpij4H/F3odHCNw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4596bf49d61fc62326d0896e364289d_JaffaCakes118

Files

a4596bf49d61fc62326d0896e364289d_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

2ab572b977f26a92420146adbb8ccc99

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA

shlwapi

PathFileExistsA
PathFindExtensionA
PathRemoveFileSpecA

winmm

PlaySoundA

setupapi

SetupIterateCabinetA

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymInitialize
SymLoadModule

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

SetFilePointer
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
InterlockedDecrement
InterlockedIncrement
lstrlenA
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
CloseHandle
HeapFree
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
GetTempPathA
SetCurrentDirectoryA
LoadLibraryA
DebugBreak
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
lstrcpynA
FormatMessageA
IsBadReadPtr
ReadProcessMemory
GetModuleFileNameA
CreateFileA
FreeEnvironmentStringsA
GlobalUnlock
GlobalLock
WinExec
VerLanguageNameA
RemoveDirectoryA
MoveFileExA
DeleteFileA
WriteFile
CopyFileA
MoveFileA
GetTempFileNameA
lstrcpyA
lstrcatA
lstrlenW
FindFirstFileA
FindNextFileA
FindClose
GlobalFree
GlobalAlloc
lstrcmpA
MulDiv
FreeLibrary
Sleep
GetTickCount
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
TerminateProcess
ReadFile
GetFullPathNameA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateThread
ResumeThread
ExitThread
HeapReAlloc
RtlUnwind
LocalFree
LocalAlloc
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
FlushFileBuffers
GetSystemTimeAsFileTime
GetCommandLineA
SetEndOfFile
ExitProcess
GetOEMCP
GetCPInfo
TlsAlloc
CompareStringA
CompareStringW
OpenProcess
GetStartupInfoA
GetFileType
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapSize
GetStringTypeA
GetStringTypeW
GetStdHandle
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetDriveTypeA
GetTimeZoneInformation
SetHandleCount
TlsFree

user32

GetSubMenu
LoadMenuA
CharUpperA
EnableMenuItem
GetMenuItemInfoA
OffsetRect
ClientToScreen
MapWindowPoints
GetAsyncKeyState
SetWindowRgn
InflateRect
IsWindowEnabled
SystemParametersInfoA
GetCapture
GetDlgCtrlID
DrawFocusRect
DrawEdge
UpdateWindow
LoadImageA
SetWindowsHookExA
TrackPopupMenu
UnhookWindowsHookEx
EndMenu
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDC
ReleaseDC
GetDesktopWindow
RedrawWindow
BeginPaint
FillRect
EndPaint
IsChild
GetSysColor
DestroyAcceleratorTable
CharLowerA
RegisterWindowMessageA
RegisterHotKey
UnregisterHotKey
SetWindowPos
InsertMenuA
PeekMessageA
GetMessagePos
DrawFrameControl
LoadBitmapA
GetCursorPos
PostMessageA
DialogBoxIndirectParamA
GetWindow
IsWindowVisible
WindowFromPoint
CallNextHookEx
SetCursor
ScreenToClient
PtInRect
GetClassNameA
DestroyCursor
SetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
EndDialog
SetFocus
SetActiveWindow
GetWindowTextLengthA
GetWindowTextA
GetWindowRect
GetClientRect
TranslateMessage
DispatchMessageA
CharUpperBuffA
DialogBoxParamA
GetActiveWindow
SetLastErrorEx
GetWindowLongA
CallWindowProcA
DefWindowProcA
CharNextA
wvsprintfA
SetTimer
LoadCursorFromFileA
CharLowerBuffA
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxA
UnregisterClassA
SetWindowLongA
RegisterClassExA
LoadCursorA
wsprintfA
GetClassInfoExA
LoadStringA
GetParent
ShowWindow
MoveWindow
SetWindowTextA
CreateWindowExA
SendMessageA
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuA
DrawTextA
CopyRect
GetMenu
AdjustWindowRectEx
GetSystemMetrics
KillTimer
GetKeyState

gdi32

GetTextExtentPoint32A
SelectObject
ExtTextOutA
SetBkMode
CreateRectRgn
GetTextMetricsA
CreateBrushIndirect
CreateRectRgnIndirect
CreatePatternBrush
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
GetTextExtentPointA
GetStockObject
GetObjectA
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontA

shell32

ShellExecuteA
SHAddToRecentDocs
SHGetFolderPathA
SHEmptyRecycleBinA
DragQueryFileA

ole32

CLSIDFromString
CLSIDFromProgID
OleInitialize
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
RegisterDragDrop
ReleaseStgMedium
StringFromGUID2
OleUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleLockRunning
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysFreeString
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VarBstrCmp
SysAllocString
VariantInit
SysStringByteLen
VariantClear
UnRegisterTypeLi
LoadTypeLi
OleCreateFontIndirect
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantChangeType
VarUI4FromStr
RegisterTypeLi
VarBstrCat

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg

Sections

.text
Size: 672KB - Virtual size: 670KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ab572b977f26a92420146adbb8ccc99

Headers

File Characteristics

Imports

wininet

shlwapi

winmm

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 672KB - Virtual size: 670KB

.rdata Size: 124KB - Virtual size: 122KB

.data Size: 20KB - Virtual size: 28KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 672KB - Virtual size: 670KB

.rdata
Size: 124KB - Virtual size: 122KB

.data
Size: 20KB - Virtual size: 28KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 44KB - Virtual size: 42KB