b0d8cda8e627c2c7063bc9c429855019_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b0d8cda8e627c2c7063bc9c429855019_JaffaCakes118
Size

412KB
MD5

b0d8cda8e627c2c7063bc9c429855019
SHA1

9ddc7f047867e45d9c6f086720355aa9bb213f86
SHA256

08bbeaa2e827e95e07b30812edeebe73b649d8f59abbc7c677f337bfdb52734c
SHA512

51e090ca5c2d32accbaedb1e34e7b5d72638c5b26876d03e04b19550372a11a77620bc36133274b0fd1fdd6481494985b4e504dae6e8ad5096a3069db0475938
SSDEEP

3072:teBhMxVnx1vl45tAxrB0UVufbP5/7FW7o+gxWqdCDJYoc7kBWnqzGuh8l:teBhAx3nxjuh/70BgxTDIPCu8l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0d8cda8e627c2c7063bc9c429855019_JaffaCakes118

Files

b0d8cda8e627c2c7063bc9c429855019_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e580a0be8e99de129d209f6099c1d614

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForMultipleObjects
FindResourceA
SizeofResource
LockResource
LoadResource
GetVersion
WaitForSingleObject
GetTempFileNameA
MulDiv
RemoveDirectoryA
CreateDirectoryA
GlobalMemoryStatus
GetDriveTypeA
IsBadWritePtr
IsBadReadPtr
LoadLibraryExA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetFileTime
GetFileSize
SetFilePointer
LoadLibraryA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FlushFileBuffers
GetLocaleInfoW
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
WriteFile
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
LCMapStringW
LCMapStringA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
ExitProcess
TlsGetValue
TlsFree
TlsAlloc
HeapAlloc
HeapFree
GetCommandLineA
ExitThread
TlsSetValue
GetCurrentThreadId
CreateThread
RaiseException
RtlUnwind
InterlockedExchange
TerminateProcess
GetSystemInfo
GetSystemDirectoryA
GetDiskFreeSpaceA
GetCurrentThread
GetCurrentProcess
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
CreateFileMappingA
FindFirstFileA
FindClose
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetVersionExA
DeleteFileA
FreeLibrary
lstrcmpA
Sleep
GetProcAddress
ReadFile
lstrcatA
LocalFree
FormatMessageA
CreateEventA
lstrcpyA
QueryPerformanceFrequency
InterlockedDecrement
InterlockedIncrement
CreateFileA
MultiByteToWideChar
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetPrivateProfileStringA
MapViewOfFile
GetShortPathNameA
lstrcmpiA
lstrlenW
GetFileAttributesA
CopyFileA
UnmapViewOfFile
SearchPathA
VirtualProtect
VirtualQuery
CompareStringW
CompareStringA
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetLocalTime
WritePrivateProfileStringA
lstrcpynA
lstrlenA
WideCharToMultiByte
GetLastError
SetLastError
GetFileType

user32

GetDlgItem
SetWindowPos
MoveWindow
GetWindowLongA
ReleaseDC
GetSysColor
FillRect
GetWindowRect
ScreenToClient
SetWindowLongA
CopyRect
GetDC
MsgWaitForMultipleObjects
DrawFocusRect
SetScrollInfo
ShowScrollBar
SetRect
PtInRect
LoadCursorA
GetWindowPlacement
LoadBitmapA
GetCursorPos
SetScrollPos
GetDialogBaseUnits
CallWindowProcA
GetParent
GetWindow
SystemParametersInfoA
MapWindowPoints
CreateDialogIndirectParamA
GetWindowTextA
LoadImageA
IsIconic
EnumChildWindows
BeginPaint
EndPaint
GetKeyState
InvalidateRect
GetDlgCtrlID
LoadIconA
SetWindowTextA
MapDialogRect
GetDlgItemTextA
GetClassNameA
MessageBoxA
GetMessageA
SetActiveWindow
IsDialogMessageA
MessageBeep
SendMessageA
LoadStringA
ShowWindow
GetClientRect
GetPropA
DefWindowProcA
PeekMessageA
TranslateMessage
DispatchMessageA
GetClassInfoA
RegisterClassA
CreateWindowExA
SetPropA
PostMessageA
RemovePropA
FindWindowA
DestroyWindow
IsWindow
EnableWindow
SetFocus
CharUpperA
GetDesktopWindow
wsprintfA
CharNextA
CharLowerBuffA

gdi32

EnumFontFamiliesExA
GetStockObject
DeleteDC
GetTextExtentPoint32A
GetDeviceCaps
CreateFontIndirectA
SaveDC
SetBkMode
SelectObject
CreateSolidBrush
SetTextColor
TextOutA
DeleteObject
RestoreDC
CreateCompatibleBitmap
GetTextMetricsA
CreateICA
CreateCompatibleDC
LineTo
MoveToEx
CreatePen
BitBlt
SetBkColor
GetTextExtentPointA
CreateBitmap
GetObjectA

winspool.drv

EnumPortsA

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHBrowseForFolderA
SHGetPathFromIDListA

ole32

GetRunningObjectTable
CoLoadLibrary
CoInitialize
CoUninitialize
CreateItemMoniker
CoTaskMemFree
StringFromCLSID
ProgIDFromCLSID
CoGetInterfaceAndReleaseStream
CLSIDFromProgID
CoCreateInstance

oleaut32

SysFreeString
VariantClear
SysStringLen
SysAllocString
SysAllocStringLen
SysReAllocStringLen
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
GetErrorInfo
CreateErrorInfo
SetErrorInfo

comctl32

ImageList_Create
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Draw
ImageList_Destroy

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

AddIcon
CallDLLFn
ComponentViewCreateWindow
ComponentViewDestroy
ComponentViewRefresh
ComponentViewSelectAll
ComponentViewSetInfo
ComponentViewSetInfoEx
CreateFolder
DeleteFolder
DeleteIcon
EnableHourGlass
EnumFoldersItems
GetCPUType
GetFontSub
GetHandle
GetPorts
GetSelectedItemState
IsEmpty
IsNTAdmin
IsOSTypeNT
IsObject
IsPowerUser
LangLoadString
MessageBeepP
PathCompactPathPixel
PathCrackUrl
PathGetDir
PathGetDrive
PathGetFile
PathGetFileExt
PathGetFileName
PathGetLongFromShort
PathGetPath
PathGetRegistryFolder
PathGetSpecialFolder
PathIsValidSyntax
QueryIcon
ReadArrayProperty
ReadBoolProperty
ReadNumberProperty
ReplaceIcon
ShowFolder
TextSubSubstitute
VerGetFileVersion
WriteArrayProperty
WriteBoolProperty
WriteNumberProperty
WriteStringProperty
_AppSearch
_BrowseForFolder
_CCPSearch
_CHARArrayToWCHARArray
_CalculateAndAddFileCost
_CleanupInet
_CloseFile
_CmdGetHwndDlg
_CmdGetMsg
_CmdGetParam1
_CmdGetParam2
_CoGetObject
_ComponentAddItem
_ComponentCompareSizeRequired
_ComponentError
_ComponentErrorInfo
_ComponentFileEnum
_ComponentFileInfo
_ComponentFilterLanguage
_ComponentFilterOS
_ComponentGetCost
_ComponentGetCostEx
_ComponentGetData
_ComponentGetItemSize
_ComponentGetTotalCost
_ComponentGetTotalCostEx
_ComponentInitialize
_ComponentIsItemSelected
_ComponentListItems
_ComponentLoadTarget
_ComponentMoveData
_ComponentPatch
_ComponentReinstall
_ComponentRemoveAll
_ComponentRemoveAllInLogOnly
_ComponentSaveTarget
_ComponentSelectItem
_ComponentSelectNew
_ComponentSetData
_ComponentSetupTypeEnum
_ComponentSetupTypeGetData
_ComponentSetupTypeSet
_ComponentTotalSize
_ComponentTransferData
_ComponentUpdate
_ComponentValidate
_ComponentViewCreate
_ComponentViewQueryInfo
_CopyBytes
_CreateDir
_CreateObject
_CreateRegistrySet
_CreateShellObjects
_CtrlGetNotificationCode
_CtrlGetSubCommand
_CtrlSetMLERichText
_DefineDialog
_DeleteCHARArray
_DialogSetFont
_DisableBranding
_DisableStatus
_Divide
_DoInstall
_DoSprintf
_EnableDialogCache
_EnablePrevDialog
_EnableSkins
_EnableStatus
_EnableWow64FsRedirection
_EndDialog
_ExistsDir
_ExistsDisk
_ExistsFile
_ExitInstall
_FeatureAddCost
_FeatureAddUninstallCost
_FeatureGetCost
_FeatureSpendCost
_FeatureSpendUninstallCost
_FileCopy
_FloatingPointOperation
_GenerateFileMD5SignatureHex
_GetByte
_GetCurrentDialogName
_GetDiskInfo
_GetDiskSpaceEx
_GetDiskSpaceExEx
_GetFont
_GetGlobalMemorySize
_GetInetFileSize
_GetInetFileTime
_GetLine
_GetLineSize
_GetObject
_GetObjectByIndex
_GetObjectCount
_GetProcessorInfo
_GetSelectedTreeComponent
_GetSupportDir
_GetTrueTypeFontFileInfo
_InetEndofTransfer
_InetGetLastError
_InetGetNextDisk
_InitInstall
_IsFontTypefaceNameAvailable
_IsSkinLoaded
_IsWindowsME
_IsWow64
_ListAddItem
_ListAddString
_ListCount
_ListCreate
_ListCurrentItem
_ListCurrentString
_ListDeleteAll
_ListDeleteItem
_ListDeleteString
_ListDestroy
_ListFindItem
_ListFindString
_ListGetFirstItem
_ListGetFirstString
_ListGetIndex
_ListGetNextItem
_ListGetNextString
_ListGetType
_ListReadFromFile
_ListSetCurrentItem
_ListSetCurrentString
_ListSetIndex
_ListWriteToFile
_MediaGetInfo
_OnUninstPriv
_OpenFile
_PlaceBitmap
_Postprogram
_Preprogram
_PrintFile
_ReadBytes
_ReadStringProperty
_RebootPutString
_Rebooted
_RegConnectRegistry
_RegCreateKey
_RegDeleteKey
_RegDeleteValue
_RegDisConnectRegistry
_RegEnableTextSubs
_RegEnum
_RegExistsKey
_RegGetOptions
_RegIsRemoteRegConnected
_RegQueryKeyBinaryValue
_RegQueryKeyValue
_RegSetKeyBinaryValue
_RegSetKeyValue
_RegSetOptions
_ReleaseDialog
_SdShowMsg
_SeekBytes
_SendRequest
_SetAltMainImage
_SetByte
_SetColor
_SetDisplayEffect
_SetFont
_SetPaletteFile
_SetSilentSdShowMsg
_SetTitle
_SetupInet
_SetupTraceWrite
_ShowObjWizardPages
_ShowWizardPages
_SizeWindow
_StatusUpdate
_TreeViewCreate
_VerGetFileLanguages
_VerUpdateFile
_WCHARArrayToCHARArray
_WaitOnDialog
_WriteBytes
_WriteLine
__CreateObjectContext
__GetCmdLineOptions
__GetContextGUID
__GetEnabledIServices
__GetFileRegistrar
__GetInfo
__GetInstallGuid
__GetLog
__GetLogDB
__GetLogEx
__GetMainWindow
__GetMaintOption
__GetMaintenanceMode
__GetObjects
__GetProductGuid
__GetProgress
__GetReboot
__GetReinstallMode
__GetRemoveAllMode
__GetTextSub
__GetUpdateMode
__GetUser
__ISRTGetPropertyBag
__ISRTReleasePropertyBag
__LoadString
__PutEnabledIServices
__ReleaseObjectContext
__RestoreMainLog
__RestoreMainLogEx
__SetComponentLog
__SetUpdateMode

Sections

.text
Size: 304KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e580a0be8e99de129d209f6099c1d614

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

version

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 301KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 24KB - Virtual size: 30KB

.rsrc Size: 4KB - Virtual size: 896B

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 304KB - Virtual size: 301KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 24KB - Virtual size: 30KB

.rsrc
Size: 4KB - Virtual size: 896B

.reloc
Size: 24KB - Virtual size: 23KB