b6ff1ed6c3cfc0b2e04b9118fe228f49_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b6ff1ed6c3cfc0b2e04b9118fe228f49_JaffaCakes118
Size

236KB
MD5

b6ff1ed6c3cfc0b2e04b9118fe228f49
SHA1

9a0beff7b57530ccd1117896594c1a474174aa72
SHA256

7348bfa5aeb8cf3b68ac808e637b80fb5a7b6476a3e3d4628b6e2b5626f8e9d9
SHA512

3cb9c886f3606ad5cd60a866578b3187f8127d507a343ac2718ef438c2dbfbc817bb6840d1bc608b1fad9776891632b6e6a9f09d1cd35c4390527102f242ea11
SSDEEP

6144:39/99b7EG/sVIMe4AXoMUbbM5l6os51P4Vw:3B9Gl3e4AXojbbil6os51Pd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6ff1ed6c3cfc0b2e04b9118fe228f49_JaffaCakes118

Files

b6ff1ed6c3cfc0b2e04b9118fe228f49_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fc17c5e53c04168336f43b2445a4874a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FormatMessageA
CreateEventA
InterlockedExchange
GetACP
GetLocaleInfoA
GetModuleHandleA
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
CompareStringW
CompareStringA
SetStdHandle
VirtualProtect
GetCurrentProcessId
LocalFree
GetStringTypeW
GetStringTypeA
LCMapStringW
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
FlushFileBuffers
ReadFile
WriteFile
IsBadWritePtr
GetFileTime
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
GetCommandLineA
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
GetVolumeInformationA
GetDiskFreeSpaceExA
GetVersionExA
ProcessIdToSessionId
Process32First
Process32Next
CreateToolhelp32Snapshot
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
LCMapStringA
SetErrorMode
MoveFileExA
GetSystemDirectoryA
CreateFileA
CloseHandle
DeviceIoControl
GetFileAttributesA
DeleteFileA
Sleep
lstrcpyA
CreateThread
SetLastError
FreeLibrary
LoadLibraryA
GetTickCount
GlobalMemoryStatus
CreatePipe
GetStartupInfoA
PeekNamedPipe
MoveFileA
GetDriveTypeA
GetLastError
SetFileTime
SetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
VirtualQuery
HeapSize
GetCurrentProcess
TerminateProcess
HeapReAlloc
ExitProcess
GetCPInfo
GetOEMCP
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
GetCurrentThreadId
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
RtlUnwind
SetEnvironmentVariableA

user32

SystemParametersInfoA
SetClipboardData
EmptyClipboard
CloseClipboard
wsprintfA
OpenClipboard
keybd_event
MapVirtualKeyA
mouse_event
GetDesktopWindow
CloseDesktop
SwitchDesktop
OpenDesktopA
GetUserObjectInformationA
OpenInputDesktop
PostMessageA
GetClassNameA
FindWindowA
GetWindowDC
EnumDesktopWindows
GetCursorPos
SetThreadDesktop
ReleaseDC
GetWindowRect
GetClipboardData
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
GetThreadDesktop

gdi32

CreateCompatibleBitmap
GdiFlush
GetObjectA
CreateBitmap
SelectObject
SetPixel
GetBitmapBits
BitBlt
GetDIBits
GetSystemPaletteEntries
CreatePalette
SelectPalette
DeleteObject
RealizePalette
CreateDCA
GetDeviceCaps
DeleteDC
CreateCompatibleDC

advapi32

CreateServiceA
RegOpenKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
CreateProcessAsUserA
FreeSid
GetKernelObjectSecurity
GetSecurityDescriptorDacl
SetEntriesInAclA
MakeAbsoluteSD
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
SetKernelObjectSecurity
AllocateAndInitializeSid
BuildTrusteeWithSidA
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RevertToSelf
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
ControlService
DeleteService
RegDeleteKeyA

shell32

CommandLineToArgvW
SHFileOperationA

ole32

CoInitialize
CoCreateInstance

ws2_32

ntohs
inet_ntoa
getpeername
inet_addr
WSACleanup
shutdown
gethostname
recvfrom
__WSAFDIsSet
send
WSAIoctl
getsockname
ntohl
WSAGetLastError
select
htons
WSADuplicateSocketA
gethostbyname

netapi32

NetUserAdd
NetApiBufferFree
NetUserEnum
NetUserDel
NetUserSetInfo
NetLocalGroupAddMembers

psapi

EnumProcesses
GetModuleBaseNameA
GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Exports

Exports

LpkPresent
ScriptApplyDigitSubstitution
ScriptApplyLogicalWidth
ScriptBreak
ScriptCPtoX
ScriptCacheGetHeight
ScriptFreeCache
ScriptGetCMap
ScriptGetFontProperties
ScriptGetGlyphABCWidth
ScriptGetLogicalWidths
ScriptGetProperties
ScriptIsComplex
ScriptItemize
ScriptJustify
ScriptLayout
ScriptPlace
ScriptRecordDigitSubstitution
ScriptShape
ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringFree
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringOut
ScriptStringValidate
ScriptStringXtoCP
ScriptString_pLogAttr
ScriptString_pSize
ScriptString_pcOutChars
ScriptTextOut
ScriptXtoCP
UspAllocCache
UspAllocTemp
UspFreeMem

Sections

.text
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc17c5e53c04168336f43b2445a4874a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

netapi32

psapi

wtsapi32

userenv

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 148KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 24KB - Virtual size: 1.0MB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 16KB - Virtual size: 12KB

.text
Size: 152KB - Virtual size: 148KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 24KB - Virtual size: 1.0MB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 16KB - Virtual size: 12KB