a9a558ee10aacde119ec0e00f1799e05_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a9a558ee10aacde119ec0e00f1799e05_JaffaCakes118
Size

1.0MB
MD5

a9a558ee10aacde119ec0e00f1799e05
SHA1

c613301f85648569246d83280c6e977a4964b2ed
SHA256

e9820b390d27f25d97d18b3a48b96d0e11236beff34671cdf237075e23d95f7a
SHA512

c9a0bebcbb5a1862bea022e11918e5eeb01179c7950001a658f9950247f0482b9a0a8e9f4cf2fb4558c9fc9bcd91f57678873b7def492b3b2006223fba3a8bbc
SSDEEP

24576:Kpo8DwzCigvpJ/7H7Ht8v/zjtmIX/ekYJLTB0QF1CsYhcPdlnryVAJWwbwxgv0sM:ywzjxURV9YsJdyUCxO/M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9a558ee10aacde119ec0e00f1799e05_JaffaCakes118

Files

a9a558ee10aacde119ec0e00f1799e05_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3e90a6fa71c012d72ebd3d5470b2e708

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
CopyFileA
GetLastError
CreateFileA
lstrcatW
DeleteFileA
CloseHandle
LoadLibraryW
CreateWaitableTimerA
GetSystemDirectoryW
GetProcAddress
LocalFree
ExitProcess
CreateProcessW
GetModuleHandleW
FreeLibrary
FlushInstructionCache
lstrcpyW
QueryFullProcessImageNameW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetVersionExW
WaitForSingleObject
CreateMutexW
GetModuleFileNameW
TerminateProcess
DeviceIoControl
GetCurrentProcess
GetCommandLineW
VirtualProtectEx
SetWaitableTimer
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
GetACP
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
UnregisterWaitEx
QueryDepthSList
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InterlockedExchange
VirtualProtect
Thread32Next
Thread32First
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
VirtualQuery
DuplicateHandle
GetCurrentThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList

user32

DispatchMessageW
PeekMessageW
TranslateMessage

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext

shell32

SHGetSpecialFolderPathA

psapi

GetModuleInformation

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathFileExistsA

wininet

InternetQueryDataAvailable
HttpOpenRequestA
InternetCrackUrlA
InternetSetOptionA
HttpAddRequestHeadersA
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetSetOptionW
InternetCloseHandle
HttpSendRequestA
InternetConnectA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
Private1
SvchostPushServiceGlobals
WinHttpAddRequestHeaders
WinHttpAutoProxySvcMain
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpConnectionDeleteProxyInfo
WinHttpConnectionFreeNameList
WinHttpConnectionFreeProxyInfo
WinHttpConnectionFreeProxyList
WinHttpConnectionGetNameList
WinHttpConnectionGetProxyInfo
WinHttpConnectionGetProxyList
WinHttpConnectionSetProxyInfo
WinHttpCrackUrl
WinHttpCreateProxyResolver
WinHttpCreateUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpFreeProxyResult
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetProxyForUrlEx
WinHttpGetProxyResult
WinHttpGetTunnelSocket
WinHttpOpen
WinHttpOpenRequest
WinHttpProbeConnectivity
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpResetAutoProxy
WinHttpSaveProxyCredentials
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetDefaultProxyConfiguration
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
WinHttpWebSocketClose
WinHttpWebSocketCompleteUpgrade
WinHttpWebSocketQueryCloseStatus
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpWebSocketShutdown
WinHttpWriteData

Sections

.text
Size: 862KB - Virtual size: 861KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e90a6fa71c012d72ebd3d5470b2e708

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

psapi

shlwapi

wininet

Exports

Exports

Sections

.text Size: 862KB - Virtual size: 861KB

.rdata Size: 135KB - Virtual size: 135KB

.data Size: 14KB - Virtual size: 19KB

.tls Size: 512B - Virtual size: 9B

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 862KB - Virtual size: 861KB

.rdata
Size: 135KB - Virtual size: 135KB

.data
Size: 14KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 9B

.reloc
Size: 32KB - Virtual size: 31KB