aa95a4a5a97f9e891e327dfd896813b1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa95a4a5a97f9e891e327dfd896813b1_JaffaCakes118
Size

304KB
MD5

aa95a4a5a97f9e891e327dfd896813b1
SHA1

0cf567c8689ad2e03a866433d6e99469ebf2e5c7
SHA256

6548c85fb92279645eb891cc0526b16685ad27ec66bc9facf43d659ab320bdb9
SHA512

5e7f0c031697bb2f490f1bad9f83d7b462098b9cba7355f8ff075414a1bd760348c0fe96a280fcec603cf146fbd8440cb51d303266e1b35d680187b1a1f2740a
SSDEEP

6144:5bu/G2hEtHvsjcoqGZVl7VPeZidJBqcRqq1oI1UqCkGUXp1CiIsVE:5bWG2NjB75hVf9Xp9dE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa95a4a5a97f9e891e327dfd896813b1_JaffaCakes118

Files

aa95a4a5a97f9e891e327dfd896813b1_JaffaCakes118
.dll .ps1 windows:4 windows x86 arch:x86 polyglot

e97b74a0f2ea1531be3dc3b14202a351

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetDesktopFolder
SHGetInstanceExplorer
SHGetMalloc
SHAddToRecentDocs

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CreateStreamOnHGlobal
OleInitialize
OleLockRunning
OleUninitialize
StringFromGUID2

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

kernel32

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetProcessPriorityBoost
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
GetVersionExA
GlobalAlloc
GlobalFree
GetACP
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByte
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LockResource
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
SetLastError
SizeofResource
VirtualAlloc
VirtualFree
VirtualProtect
WideCharToMultiByte
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
lstrlenW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
FindResourceA
FlushInstructionCache
FreeLibrary
GlobalHandle

oleaut32

VarUI4FromStr
VariantClear
VariantInit
SysStringByteLen
SysFreeString
SysAllocStringLen
SysAllocString
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
SysStringLen

gdi32

GetStockObject
GetObjectA
GetDeviceCaps
RestoreDC
SaveDC
SelectObject
SetBkMode
SetGraphicsMode
SetTextColor
SetViewportOrgEx
SetWindowOrgEx
ModifyWorldTransform
DeleteDC
DPtoLP
CreateSolidBrush
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject

user32

wsprintfA
UnregisterClassA
SetWindowTextA
SetWindowPos
SetWindowLongA
SetWindowContextHelpId
SetFocus
BeginPaint
CallWindowProcA
CharNextA
CreateAcceleratorTableA
CreateWindowExA
DefWindowProcA
DestroyAcceleratorTable
DestroyWindow
DialogBoxIndirectParamA
EnableWindow
EndDialog
EndPaint
FillRect
GetActiveWindow
GetClassInfoExA
GetClassNameA
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetFocus
GetParent
GetSysColor
GetWindow
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
InvalidateRect
InvalidateRgn
IsChild
IsWindow
LoadCursorA
LoadStringA
MapDialogRect
MessageBoxA
PtInRect
RedrawWindow
RegisterClassExA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
SendMessageA
SetCapture
SetCursor

comctl32

ord17

ddraw

DirectDrawEnumerateA
DSoundHelp

Exports

Exports

ComputeTangentFrameEx
CreateEffectCompilerFromResourceW
CreateTextureFromFileA
GetDefaultLoadFileOption
GetImageInfoFromResourceA
IntersectTri
QuaternionRotationMatrix
QuaternionToAxisAngle
SetSaveResolution
WeldVertices
mpegInGetNextFrame
mpegSplitClose

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e97b74a0f2ea1531be3dc3b14202a351

Headers

File Characteristics

Imports

shell32

ole32

advapi32

kernel32

oleaut32

gdi32

user32

comctl32

ddraw

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 152KB - Virtual size: 151KB

.data Size: 43KB - Virtual size: 43KB

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 152KB - Virtual size: 151KB

.data
Size: 43KB - Virtual size: 43KB

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 3KB - Virtual size: 2KB