b22513aea28b8edd6906d915b3ad1f53_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b22513aea28b8edd6906d915b3ad1f53_JaffaCakes118
Size

71KB
MD5

b22513aea28b8edd6906d915b3ad1f53
SHA1

cfcdbd811f0d1d5bf6fc095ce81ad0f78b58ad91
SHA256

f2fea5888bd0ed01dccd2728587b1f3955799404978bfc559d0eb387922ff611
SHA512

d17e5539706b8cf1e699f06ad826c6c634bbbbf2ecfb9e069f21e3be23f7fbe36bf2951e98315f890907d9f5225c421b2512bebf94a19bc3091c3204b72155c8
SSDEEP

1536:2zltvvFk/hHhEK6m97+R+XAzzlzBJAD46sI/xIr:sjXFithEK6m97FXA/JesI/xIr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b22513aea28b8edd6906d915b3ad1f53_JaffaCakes118

Files

b22513aea28b8edd6906d915b3ad1f53_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a662519368ff627333ea0253fc70f857

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ExitWindowsEx
MessageBoxA
GetActiveWindow
GetUserObjectInformationA
EnumChildWindows
SetWindowsHookExW
GetForegroundWindow
OpenWindowStationA
SetProcessWindowStation
OpenInputDesktop
GetThreadDesktop
SendInput
SetCursorPos
PostMessageA
OpenDesktopA
wsprintfA
CharUpperA
GetWindowTextA
GetWindowThreadProcessId
EnumWindows
UpdateWindow
BringWindowToTop
ShowWindow
DispatchMessageA
GetMessageA
DestroyWindow
SendMessageA
CreateDesktopA
IsWindow
PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
SetThreadDesktop
CallNextHookEx

gdi32

GetDIBits
GetDeviceCaps
CreateDCA
CreateCompatibleDC
SelectObject
DeleteObject
CreateCompatibleBitmap
DeleteDC
BitBlt

advapi32

LookupPrivilegeValueA
OpenProcessToken
ImpersonateSelf
OpenThreadToken
RegCreateKeyExA
ChangeServiceConfigA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegQueryValueExA
CreateServiceA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
QueryServiceConfigA
EnumServicesStatusA
DeleteService
StartServiceA
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
AdjustTokenPrivileges

shell32

SHEmptyRecycleBinA
ShellExecuteA
SHFileOperationA

ole32

CreateStreamOnHGlobal

ws2_32

htons
closesocket
gethostbyname
inet_addr
WSAStartup
WSADuplicateSocketA
WSASocketA
send
recv
select
inet_ntoa
getsockname
ntohs
accept
listen
setsockopt
bind
socket
connect

shlwapi

StrStrA
StrCmpW
StrToIntA
StrCmpNIA
StrRChrA
StrChrA
SHDeleteKeyA

psapi

GetModuleFileNameExA
EnumProcesses

wininet

HttpQueryInfoA
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmGetContext

msvcrt

_initterm
_adjust_fdiv
strchr
strcpy
malloc
wcscmp
free
_EH_prolog
__CxxFrameHandler
abs
_beginthread
memcpy
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
strstr

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

winmm

waveInClose
waveInStop
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInUnprepareHeader

kernel32

SetThreadPriority
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
SetFilePointer
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
lstrcatA
OpenEventA
CallNamedPipeA
GetStartupInfoA
GetModuleFileNameA
GetSystemDirectoryA
GetLocalTime
WideCharToMultiByte
lstrlenW
ExitProcess
GetFileAttributesA
CreateThread
GetProcAddress
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
GlobalMemoryStatus
GetComputerNameA
GetSystemInfo
GetOEMCP
DeviceIoControl
CreateProcessA
GetStdHandle
CreatePipe
SetStdHandle
DuplicateHandle
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
GetCurrentProcessId
lstrcmpiA
FindFirstFileA
lstrcmpA
FindNextFileA
GetLastError
FindClose
GetFileAttributesExA
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetDriveTypeA
lstrcpyA
MoveFileA
CreateDirectoryA
WriteFile
GetTempPathA
lstrlenA
GetFileSize
DeleteFileA
GlobalAlloc
GlobalLock
lstrcpyW
WaitForMultipleObjects
GetCurrentThreadId
SetEvent
Sleep
GetVersionExA
GetVersion
QueryPerformanceCounter
GetACP
QueryPerformanceFrequency
CloseHandle
ReadFile
GetTickCount
GetFileSizeEx
CreateFileA
CreateMutexA
CreateEventA
GlobalFree
ReleaseMutex
ResetEvent
WaitForSingleObject
LoadLibraryA
SetFilePointerEx

Exports

Exports

DoMainWork DoService
DoService
ServiceMain

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a662519368ff627333ea0253fc70f857

Headers

File Characteristics

Imports

user32

gdi32

advapi32

shell32

ole32

ws2_32

shlwapi

psapi

wininet

imm32

msvcrt

avicap32

winmm

kernel32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 1024B - Virtual size: 1KB

Share Size: 4KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 1024B - Virtual size: 1KB

Share
Size: 4KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB