ae925acba01e2b4ad3bb4db76e9958cd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ae925acba01e2b4ad3bb4db76e9958cd_JaffaCakes118
Size

141KB
MD5

ae925acba01e2b4ad3bb4db76e9958cd
SHA1

cc5d89393724423dd567fcfb20a79e0d54da8e06
SHA256

066067286f58587696534ce4b22ec81467dcbf05405f53820e3aed9562b2eaa1
SHA512

3b64ea16e74e7d92c0922cfb645bc36228b7ffb681120e99ae68641c171d6579389b97a1a8ad48ed358eb43c1884e447c62d05ff5df262461d5c2e6603306589
SSDEEP

3072:gbf9cjv/2NR+6fFrgU1xqeZ8fHIVPNONZd8VPH2Ob0kOS3:gbfD33xqeZF2Zd8Vf2Ob0d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae925acba01e2b4ad3bb4db76e9958cd_JaffaCakes118

Files

ae925acba01e2b4ad3bb4db76e9958cd_JaffaCakes118
.dll windows:5 windows x86 arch:x86

89f6053c02768a182a2845b2149ca024

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
SizeofResource
LoadLibraryExW
SetThreadLocale
GetThreadLocale
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
WaitForSingleObject
GetCurrentProcessId
GetTickCount
lstrcmpiW
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
InitializeCriticalSection
GetFileAttributesA
CreateDirectoryA
GetLocalTime
GetModuleHandleW
OutputDebugStringW
SetLastError
GetProcAddress
CreateEventW
ResetEvent
SetEvent
GlobalHandle
QueryPerformanceCounter
CloseHandle
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
RaiseException
MulDiv
lstrcmpW
GetCurrentProcess
FlushInstructionCache
lstrlenW
FindResourceW
LoadResource
LockResource
lstrlenA
MultiByteToWideChar
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
Sleep
GlobalFree
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetSystemTimeAsFileTime

user32

SetWindowLongW
GetWindowLongW
CreateWindowExW
SetWindowPos
PostMessageW
GetWindow
SetWindowContextHelpId
SendMessageW
EndDialog
MapDialogRect
SendDlgItemMessageW
UnregisterClassA
CreateDialogIndirectParamW
PostThreadMessageW
ShowWindow
UpdateWindow
RegisterDeviceNotificationW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterDeviceNotification
PostQuitMessage
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW
LoadCursorW
GetClassInfoExW
IsWindow
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
DestroyWindow
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
CharNextW
GetSysColor
DefWindowProcW

gdi32

PatBlt
CreateDIBSection
StretchDIBits
SetDIBitsToDevice
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
SelectObject
DeleteDC

shell32

SHGetFolderPathA

ole32

CoCreateInstance
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
CoTaskMemFree
OleUninitialize

oleaut32

SysFreeString
SysAllocStringLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantClear
VariantInit
SysAllocString
SysStringLen

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueA

ingxclid

ord100
ord107
ord103
ord106
ord101
ord102

shlwapi

PathAppendA

cimage

?setImageReady@CImage@@QAEX_N@Z
?setImageData@CImage@@QAEXPAEI_N@Z
??0CImage@@QAE@HGGGW4Endianness@0@@Z
??1CImage@@UAE@XZ
?applyFlip@CImage@@QAE_ND@Z
?getSourceDeviceId@CImage@@QBEHXZ
?processImage@CImage@@QAE_NXZ
?isImageProcessed@CImage@@QBE_NXZ

msvcr100

fprintf
strrchr
fopen_s
remove
_findclose
_findnext32
_findfirst32
_itoa
_CIpow
wcstombs
strncmp
_vswprintf
strchr
malloc
swprintf_s
memset
_recalloc
calloc
memcpy_s
free
_purecall
_beginthread
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
vfprintf
memmove
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
_beginthreadex
wcsstr
wcscpy_s
wcsncpy_s
wcscat_s
_wcsnicmp
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
_wfopen
fwrite
??_U@YAPAXI@Z
fclose
?terminate@@YAXXZ

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??1_Container_base12@std@@QAE@XZ

Exports

Exports

?GetIDeviceImpl@@YAPAXXZ
?ReleaseDevice@@YAXPAUIDevice@@@Z

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89f6053c02768a182a2845b2149ca024

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

ingxclid

shlwapi

cimage

msvcr100

msvcp100

Exports

Exports

Sections

.text Size: 95KB - Virtual size: 94KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 95KB - Virtual size: 94KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 8KB