ac1697e9626f5650ffeda8db67799298_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ac1697e9626f5650ffeda8db67799298_JaffaCakes118
Size

292KB
MD5

ac1697e9626f5650ffeda8db67799298
SHA1

276977590dec91b70dbb472b1a3009e817643755
SHA256

28e9d019959eb6aa91224e6391dffd95cd8bed57e50e20a27bea02c70a1ded1a
SHA512

f3a918fb9613c6c6776ac4afcefab9f699a538709d851baf791df0f4789a3d7df290c9b312793eb0a1304384aac791794be9588cd7b22d87d73d276f5acf6133
SSDEEP

6144:jM2hoPPHGR0ss/XHYvPEuZoqROnUJLhu3Iwt3hUagh:jroPmR0ss/aoaOnUJLhu4wo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac1697e9626f5650ffeda8db67799298_JaffaCakes118

Files

ac1697e9626f5650ffeda8db67799298_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

19447bc59ee8ce745e02199472628b7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mpr

WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW

winmm

mciSendStringW
timeGetTime

comctl32

ord17

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcAddress
InterlockedIncrement
InterlockedDecrement
Sleep
GetCurrentThreadId
GetVersionExW
GetCurrentProcess
GetSystemInfo
LoadLibraryA
FormatMessageW
GetDriveTypeW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalLock
GlobalUnlock
GlobalAlloc
OpenProcess
TerminateProcess
CloseHandle
GetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
SetPriorityClass
QueryPerformanceCounter
QueryPerformanceFrequency
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
FindFirstFileW
FindClose
GetFullPathNameW
FindResourceW
SetSystemPowerState
WideCharToMultiByte
GetStringTypeW
GetStringTypeA
LCMapStringA
RtlUnwind
GetCurrentProcessId
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
HeapReAlloc
VirtualAlloc
VirtualFree
LCMapStringW
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
lstrlenW
FreeLibrary
CompareStringW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetModuleHandleA
CreateFileA

user32

CharLowerBuffW
GetMenuItemID
GetSubMenu
GetClientRect
GetCaretPos
IsIconic
IsZoomed
CreateWindowExW
MonitorFromPoint
GetMonitorInfoW
CopyRect
FindWindowW
SetWindowLongW
SetLayeredWindowAttributes
GetKeyboardLayoutNameA
VkKeyScanA
keybd_event
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
SystemParametersInfoW
ExitWindowsEx
CharUpperBuffW
GetMenuStringW
GetMenuItemCount
GetMenu
SetWindowPos
ClientToScreen
GetCursor
WindowFromPoint
LoadCursorW
mouse_event
GetCursorPos
ReleaseDC
GetDC
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
GetForegroundWindow
IsWindowEnabled
IsWindowVisible
ShowWindow
EnableWindow
MoveWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
SendMessageTimeoutW
GetFocus
GetWindowTextW
ScreenToClient
EnumChildWindows
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetFocus
CharNextW
SetForegroundWindow

gdi32

GetDIBits
CreateCompatibleBitmap
GetPixel
DeleteDC
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

RegOpenKeyExW
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumValueW
RegQueryValueExW
RegConnectRegistryW
CreateProcessWithLogonW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

shell32

DragQueryFileW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

RegisterTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
UnRegisterTypeLi
VariantInit
SafeArrayAllocDescriptorEx
SafeArrayAllocData
SafeArrayAccessData
VariantCopy
SafeArrayUnaccessData
VariantClear
BSTR_UserFree
VARIANT_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserSize
BSTR_UserSize
VARIANT_UserMarshal
LoadRegTypeLi
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SysAllocString

rpcrt4

NdrDllCanUnloadNow
NdrStubCall2
NdrDllRegisterProxy
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy

Exports

Exports

AU3_AutoItSetOption
AU3_BlockInput
AU3_CDTray
AU3_ClipGet
AU3_ClipPut
AU3_ControlClick
AU3_ControlCommand
AU3_ControlDisable
AU3_ControlEnable
AU3_ControlFocus
AU3_ControlGetFocus
AU3_ControlGetHandle
AU3_ControlGetPosHeight
AU3_ControlGetPosWidth
AU3_ControlGetPosX
AU3_ControlGetPosY
AU3_ControlGetText
AU3_ControlHide
AU3_ControlListView
AU3_ControlMove
AU3_ControlSend
AU3_ControlSetText
AU3_ControlShow
AU3_ControlTreeView
AU3_DriveMapAdd
AU3_DriveMapDel
AU3_DriveMapGet
AU3_IniDelete
AU3_IniRead
AU3_IniWrite
AU3_Init
AU3_IsAdmin
AU3_MouseClick
AU3_MouseClickDrag
AU3_MouseDown
AU3_MouseGetCursor
AU3_MouseGetPosX
AU3_MouseGetPosY
AU3_MouseMove
AU3_MouseUp
AU3_MouseWheel
AU3_Opt
AU3_PixelChecksum
AU3_PixelGetColor
AU3_PixelSearch
AU3_ProcessClose
AU3_ProcessExists
AU3_ProcessSetPriority
AU3_ProcessWait
AU3_ProcessWaitClose
AU3_RegDeleteKey
AU3_RegDeleteVal
AU3_RegEnumKey
AU3_RegEnumVal
AU3_RegRead
AU3_RegWrite
AU3_Run
AU3_RunAsSet
AU3_RunWait
AU3_Send
AU3_SendA
AU3_Shutdown
AU3_Sleep
AU3_StatusbarGetText
AU3_ToolTip
AU3_WinActivate
AU3_WinActive
AU3_WinClose
AU3_WinExists
AU3_WinGetCaretPosX
AU3_WinGetCaretPosY
AU3_WinGetClassList
AU3_WinGetClientSizeHeight
AU3_WinGetClientSizeWidth
AU3_WinGetHandle
AU3_WinGetPosHeight
AU3_WinGetPosWidth
AU3_WinGetPosX
AU3_WinGetPosY
AU3_WinGetProcess
AU3_WinGetState
AU3_WinGetText
AU3_WinGetTitle
AU3_WinKill
AU3_WinMenuSelectItem
AU3_WinMinimizeAll
AU3_WinMinimizeAllUndo
AU3_WinMove
AU3_WinSetOnTop
AU3_WinSetState
AU3_WinSetTitle
AU3_WinSetTrans
AU3_WinWait
AU3_WinWaitA
AU3_WinWaitActive
AU3_WinWaitActiveA
AU3_WinWaitClose
AU3_WinWaitCloseA
AU3_WinWaitNotActive
AU3_WinWaitNotActiveA
AU3_error
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19447bc59ee8ce745e02199472628b7a

Headers

File Characteristics

Imports

mpr

winmm

comctl32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

Exports

Exports

Sections

.text Size: 215KB - Virtual size: 214KB

.orpc Size: 512B - Virtual size: 45B

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 9KB - Virtual size: 82KB

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 215KB - Virtual size: 214KB

.orpc
Size: 512B - Virtual size: 45B

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 9KB - Virtual size: 82KB

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 13KB - Virtual size: 12KB