a4cf112ea167307db1d9fb08e2f87674_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a4cf112ea167307db1d9fb08e2f87674_JaffaCakes118
Size

256KB
MD5

a4cf112ea167307db1d9fb08e2f87674
SHA1

55b78a3d4b05a2d4ead547b1e9433a6200a97c36
SHA256

5d5b27ce21059bdd48e27ec7ba25e859edb3c81058126ad48d88325a0ded3e44
SHA512

1ec16a5c8943421e774be47650f81b3eeb684615b489589b99b19531676aaaf7bff5d17e6707ec427defb2f6de3a8e8c937c2214b1bab8f1014d359e47294f27
SSDEEP

3072:jIsjTGInEAad1KwZQiYQE35F6Ythgp55WB7mD8:jIs/EdvJYZF6AR7F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4cf112ea167307db1d9fb08e2f87674_JaffaCakes118

Files

a4cf112ea167307db1d9fb08e2f87674_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

165f4ec3b0f261cbc0c9333c004d3dc0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\work\0047.BHO\bho\BHO_full_tbws\release\vmmreg32.pdb

Imports

winhttp

WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetDefaultProxyConfiguration
WinHttpCloseHandle
WinHttpConnect
WinHttpOpenRequest
WinHttpSetTimeouts

kernel32

GetProcAddress
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
lstrlenW
lstrlenA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
GetModuleFileNameW
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
GetModuleHandleExW
DisableThreadLibraryCalls
GetCurrentProcess
FindResourceExW
Sleep
WriteFile
ReadFile
GlobalFree
GetTickCount
SetFilePointer
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FreeLibrary
CloseHandle
GetWindowsDirectoryW
SetEnvironmentVariableA
GetConsoleMode
GetStringTypeA
GetStringTypeW
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
LockResource
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
VirtualAlloc
VirtualFree
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
IsValidCodePage
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
RtlUnwind
GetCurrentProcessId
GetCurrentThreadId
GetCommandLineA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess

user32

CharNextW
UnregisterClassA

advapi32

RegDeleteKeyW
GetUserNameW
RegEnumKeyExW
OpenServiceW
StartServiceW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
OpenSCManagerW
CreateServiceW
CloseServiceHandle

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
RegisterTypeLi
SysStringLen

shlwapi

SHRegCreateUSKeyW
SHRegSetUSValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

165f4ec3b0f261cbc0c9333c004d3dc0

Headers

File Characteristics

PDB Paths

Imports

winhttp

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 105KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 80KB - Virtual size: 78KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 108KB - Virtual size: 105KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 80KB - Virtual size: 78KB

.reloc
Size: 12KB - Virtual size: 10KB