a4f299ce06538c6ece7cfadedae1f3eb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a4f299ce06538c6ece7cfadedae1f3eb_JaffaCakes118
Size

132KB
MD5

a4f299ce06538c6ece7cfadedae1f3eb
SHA1

5edf008cdf64cfb09af54fd7cf6cb8c81fed9694
SHA256

91ca6da34eddf7223c142000efab06f483fdad36ffcf809eaa00f6985cbc9bfa
SHA512

3be00e147eb0a04076b5a491cfb4674e3cc5199ff48bb2e16ff4eb1af2745104677c11cd6cb20236647e07daa7155918c83f0e95874ab2b83573b7526bab1584
SSDEEP

1536:JPcjcp8RQTf8kboy1kYt/wEHuxcCWPj5tyGWxawO4oQpeDZIjbew3pfQjrrRwylz:JPcjTEbb3/wEyuaNZ8DZOWjX+yl4KH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4f299ce06538c6ece7cfadedae1f3eb_JaffaCakes118

Files

a4f299ce06538c6ece7cfadedae1f3eb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

0953e4ca362d2e2866568fd6a2356f8c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Envon\EvShell_Ev09\EnvoShell\Release\EnvoShell.pdb

Imports

kernel32

WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
OpenProcess
FreeLibrary
LoadLibraryW
CreateMutexW
CreateFileA
GetModuleFileNameA
ExitProcess
DeleteFileA
CreateProcessW
GetSystemDirectoryW
GetCurrentThreadId
WriteFile
PeekNamedPipe
GetStartupInfoW
CreatePipe
GetTempPathW
GetModuleFileNameW
GetWindowsDirectoryW
SetEvent
GlobalMemoryStatus
GetCurrentProcess
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MultiByteToWideChar
lstrlenA
GetExitCodeThread
VirtualFree
GetComputerNameW
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile
GetStringTypeW
GetStringTypeA
GetDiskFreeSpaceExW
FlushFileBuffers
SetStdHandle
IsBadCodePtr
ReadProcessMemory
GetCPInfo
GetOEMCP
LoadLibraryA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
HeapSize
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
HeapCreate
HeapDestroy
GetModuleHandleA
TlsGetValue
TlsSetValue
TlsFree
CreateDirectoryW
MoveFileA
CreateProcessA
InterlockedExchange
ReadFile
CreateFileW
GetFileSize
CloseHandle
GetVolumeInformationW
CreateThread
lstrcpyW
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
SetLastError
TlsAlloc
VirtualQuery
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
VirtualFreeEx
WideCharToMultiByte
GetLastError
Sleep
GetModuleHandleW
CreateEventW
lstrlenW
lstrcatW
FindFirstFileW
FindNextFileW
FindClose
IsBadReadPtr
GetDriveTypeW
GetLocaleInfoA
GetACP

user32

TranslateMessage
GetMessageW
CreateWindowExW
IsWindow
SendMessageW
GetDesktopWindow
RegisterClassW
DispatchMessageW
LoadIconW
GetAsyncKeyState
GetKeyState
GetForegroundWindow
mouse_event
SetCursorPos
keybd_event
KillTimer
SetTimer
LoadCursorW
DefWindowProcW
GetWindowThreadProcessId
GetWindowLongW
GetSystemMetrics
CloseWindowStation
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
FindWindowW
wsprintfW
PostMessageW
RegisterWindowMessageW
SendMessageTimeoutW
GetClassNameW
GetCursor
IsRectEmpty
GetDC
ReleaseDC
GetWindowTextA
EnumChildWindows

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoInitialize

shell32

SHFileOperationW
ShellExecuteA

oleaut32

VariantInit
VariantClear
SysFreeString

ws2_32.dll�

ord14
ord11
ord19
ord15
ord18
ord5
ord16
ord3
ord115
ord8
ord9
ord4
ord23
ord12
ord52

avicap32

capGetDriverDescriptionW
capCreateCaptureWindowW

gdi32

GetStockObject
GetDIBits
RealizePalette
SelectPalette
GetObjectW
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject

psapi

EnumProcessModules
GetModuleFileNameExW

wininet

InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile

Exports

Exports

DownCtrlAltDel
GetDllModuleControl
HideService
StartServer
WaitServer

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DKShell
Size: 4KB - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0953e4ca362d2e2866568fd6a2356f8c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

ws2_32.dll�

avicap32

gdi32

psapi

wininet

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 12KB

.DKShell Size: 4KB - Virtual size: 520B

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 12KB

.DKShell
Size: 4KB - Virtual size: 520B

.reloc
Size: 12KB - Virtual size: 8KB