a4ac34e45417f2e6728a67f45adba8a5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a4ac34e45417f2e6728a67f45adba8a5_JaffaCakes118
Size

51KB
MD5

a4ac34e45417f2e6728a67f45adba8a5
SHA1

3684363b31bb32ef5396f267f4ad3cbd23a581fa
SHA256

166bf08f97bea3b4eb507d9816525d555bac3a7fb416f35c73b2ab4dc9f79b2f
SHA512

8246791554e3348d605bd93cf2f2263ecf74903a6fd4e777fb50d89d753b85f9719504842a6bdec8381192830a9af9470bab1880272ca5045dc86123c5ae4381
SSDEEP

768:uhonrMB0PXYfgPc0LcPAekYpNB/rwhNvvuirbc0VeXweWiqIgADHZ:LXPIfgE9YY3drwhNHfbHVgwkqwZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack004/spm1316.dll
unpack004/spmsg.dll

Files

a4ac34e45417f2e6728a67f45adba8a5_JaffaCakes118
.eml
dima_vir.zip
.zip
dima_vir.b64
.eml
attachment-1
.zip
spm1316.dll
.dll regsvr32 windows:4 windows x86 arch:x86

9170a54e1466ac09cc5a3354dfc65ea8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFileExistsA
PathAddBackslashA
SHSetValueA
PathFindExtensionA

rpcrt4

UuidCreate

kernel32

GetLastError
MultiByteToWideChar
WideCharToMultiByte
RaiseException
InitializeCriticalSection
DeleteCriticalSection
lstrcatA
lstrlenA
GetModuleFileNameA
lstrlenW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
CreateFileA
SetFilePointer
SetEndOfFile
GetTempFileNameA
GetTempPathA
DeleteFileA
MapViewOfFileEx
CreateFileMappingA
GetFileSize
OpenFileMappingA
UnmapViewOfFile
GetTickCount
HeapFree
DisableThreadLibraryCalls
ReleaseMutex
WaitForSingleObject
CreateMutexA
IsDBCSLeadByte
lstrcpynA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
Sleep
GetProcessHeap
UnlockFile
WriteFile
LockFile
CreateProcessA
GetLocaleInfoA
lstrcmpA
ReadFile
GetPrivateProfileStringA
WritePrivateProfileStringA
GetSystemTimeAsFileTime
InterlockedExchange
HeapReAlloc
RtlUnwind
VirtualQuery
HeapAlloc
lstrcpyA
GetVersionExA

user32

PeekMessageA
TranslateMessage
DispatchMessageA
CharNextA
wsprintfA

advapi32

GetUserNameA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringLen
VariantInit
VariantClear
VariantChangeType
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
LoadRegTypeLi
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
spm1316.ini
spm1316.tmp
spmsg.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
email-plain-1.txt

Sharing

General

Malware Config

Signatures

Files

9170a54e1466ac09cc5a3354dfc65ea8

Headers

File Characteristics

Imports

shlwapi

rpcrt4

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 8B

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 8B