a0d087f8906f73c49f70720c234f9cff_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a0d087f8906f73c49f70720c234f9cff_JaffaCakes118
Size

389KB
MD5

a0d087f8906f73c49f70720c234f9cff
SHA1

3f20a66cd571f1c4a5f4deaa1e065a480f19b1d3
SHA256

ac2103b8b10990ca748ad46c7b1c7656c8e37db3d53a5e789ebc9a4c02578ad7
SHA512

ad1a0b246cfc92c5e8c9acfa2c94fe4bcac7082932b860b4af3cca3a4d26135402606d9e90880df414c301696a8d1f11d386576b815bee60bd6c691aec053c3a
SSDEEP

6144:O9/Aa9r1abzJQzd+zC2ZrFx/P7vgzO1Z9m+aHahyJigLL41D1UUSuAC/vW95f4:m/A25abzJQzp0Fx7Xhyjve1RlAp34

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0d087f8906f73c49f70720c234f9cff_JaffaCakes118

Files

a0d087f8906f73c49f70720c234f9cff_JaffaCakes118
.dll windows:5 windows x86 arch:x86

bf2619172059992da8431098ceeca99e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\sharemedia\rel32\sharemedia.pdb

Imports

ole32

CoUninitialize
CoInitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance

user32

PostThreadMessageA
DispatchMessageA
GetMessageA
PostMessageA
FindWindowExA
CharNextA
SetLastErrorEx
GetWindowThreadProcessId
GetSystemMetrics
FlashWindow
AttachThreadInput
RegisterWindowMessageA
RegisterClassExA
GetClassInfoExA
CreateWindowExA
DefWindowProcA
DestroyWindow
UnregisterClassA
SystemParametersInfoA
IsIconic
ShowWindow
SetForegroundWindow
GetForegroundWindow

advapi32

RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA

kernel32

GetVersion
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
ReadFile
GetFileSize
CreateFileW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
SetErrorMode
RaiseException
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
GetLastError
lstrlenA
MultiByteToWideChar
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
lstrlenW
GetModuleHandleA
GetModuleFileNameA
IsDBCSLeadByte
GetCurrentThreadId
CloseHandle
WaitForSingleObject
SetEvent
CreateEventA
InterlockedExchange
GetVersionExA
IsBadReadPtr
VirtualProtect
VirtualQuery
SetLastError
IsBadWritePtr
CreateProcessW
FreeLibrary
LoadLibraryA
GetCurrentProcessId
GetEnvironmentVariableA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetCurrentProcess
Sleep
GetModuleHandleExA
GetProcAddress

shell32

ShellExecuteA
SHGetFileInfoA

oleaut32

SysAllocStringLen
VariantCopy
VariantChangeType
SysStringLen
SysFreeString
VariantInit
SysStringByteLen
VarBstrCat
VariantClear
SysAllocString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
GetErrorInfo

shlwapi

PathFileExistsA
PathCreateFromUrlA
PathFindExtensionW
PathCreateFromUrlW
PathAppendW
PathFindFileNameA

gdi32

CreateDIBSection
GetObjectA
SetDIBColorTable
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject

msvcp90

??0strstreambuf@std@@QAE@PBDH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
??1strstreambuf@std@@UAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0strstreambuf@std@@QAE@H@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?freeze@strstreambuf@std@@QAEX_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?pcount@strstreambuf@std@@QBEHXZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@

msvcr90

srand
_stricmp
wcstol
??0exception@std@@QAE@ABQBDH@Z
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_putenv
_ultoa
printf
rand
??3@YAXPAX@Z
??_V@YAXPAX@Z
malloc
free
memcpy_s
strcpy_s
strncpy_s
??2@YAPAXI@Z
_wcsicmp
_resetstkoflw
_purecall
_recalloc
calloc
memset
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
memmove_s
??8type_info@@QBE_NABV0@@Z
_beginthreadex
_vscwprintf
vswprintf_s
wcsnlen
realloc
atol
memcpy
sprintf
_vsnprintf
strchr
strtol
strrchr
_ismbblead
atoi
_time32

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneImage
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipGetImagePaletteSize
GdipSaveImageToStream
GdipDisposeImage
GdipFree

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 184KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf2619172059992da8431098ceeca99e

Headers

File Characteristics

PDB Paths

Imports

ole32

user32

advapi32

kernel32

shell32

oleaut32

shlwapi

gdi32

msvcp90

msvcr90

gdiplus

version

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 134KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 184KB - Virtual size: 185KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 135KB - Virtual size: 134KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 184KB - Virtual size: 185KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 19KB - Virtual size: 18KB