b7d5b3888ff6ff2a1a30ce191b001fb9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b7d5b3888ff6ff2a1a30ce191b001fb9_JaffaCakes118
Size

416KB
MD5

b7d5b3888ff6ff2a1a30ce191b001fb9
SHA1

77afb37a47a20b306f6f02e9c01ca9568a1cdd06
SHA256

f89b92964da1cd5cb285bbdfe9f1d5511ae20e4e3932802d4138fc6ad18e929d
SHA512

15d3f20cbba3673f6e33413d924eb8db20a336a5aabdcd15ed49356d4cd8592818285463d102f70e04af7eec25ad9cc181bc73bc9411be06f227017a6164075d
SSDEEP

12288:QI02r9qvqCIS/5A0vvjZYufYuCBQIct/V+d:QIhYE+5AUv93ZQVci

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7d5b3888ff6ff2a1a30ce191b001fb9_JaffaCakes118

Files

b7d5b3888ff6ff2a1a30ce191b001fb9_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7aac05df98f85de89900a0dcf683dc73

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetTempFileNameA
GetTempPathA
lstrcpynA
GlobalSize
GlobalHandle
IsBadReadPtr
GetLocalTime
OpenFile
GetWindowsDirectoryA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
GetLastError
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
IsDBCSLeadByte
GetFileSize
Sleep
TlsAlloc
TlsFree
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
VirtualAlloc
VirtualFree
FlushFileBuffers
TlsSetValue
TlsGetValue
GetTickCount
FreeResource
LockResource
GetSystemDirectoryA
GetEnvironmentVariableA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
ReadFile
GlobalReAlloc
SetFilePointer
CreateFileA
WriteFile
CloseHandle
DeleteFileA
GetProcAddress
LoadLibraryA
FreeLibrary
lstrcatA
GlobalUnlock
GlobalFree
lstrlenA
GlobalAlloc
GlobalLock
lstrcpyA
IsBadCodePtr
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
UnhandledExceptionFilter
GetEnvironmentStringsW
RtlUnwind
VirtualProtect
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
ExitProcess
SetUnhandledExceptionFilter
SetLastError
HeapDestroy
HeapCreate
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

wsprintfA
SetRect
OffsetRect
DrawTextA
ReleaseDC
wvsprintfA
CharNextA
TranslateMessage
GetMessageA
DispatchMessageA
GetDesktopWindow
LoadStringA
CloseClipboard
EmptyClipboard
SetClipboardData
GetDC
OpenClipboard

gdi32

CreateCompatibleDC
SelectObject
SetBkMode
GetObjectA
SetTextColor
DeleteObject
DeleteDC
CreateDIBSection

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

oleaut32

VarUI4FromStr

Exports

Exports

?PS_GethImage@@YGJKPAJ@Z
PS_CancelPendingXfers
PS_CloseSession
PS_CopyToClipboard
PS_CutToClipboard
PS_GetCapAdvanced
PS_GetCapDefault
PS_GetCapDesc
PS_GetCapExtInfoCount
PS_GetCapExtInfoIndex
PS_GetCapItem
PS_GetCapItemOut
PS_GetCapItemString
PS_GetCapMax
PS_GetCapMaxOut
PS_GetCapMin
PS_GetCapMinOut
PS_GetCapNumItems
PS_GetCapNumItemsOut
PS_GetCapStep
PS_GetCapString
PS_GetCapSupported
PS_GetCapType
PS_GetCapTypeOut
PS_GetCapValue
PS_GetCapValueOut
PS_GetCapability
PS_GetCaption
PS_GetCaptionHeight
PS_GetCaptionLeft
PS_GetCaptionTop
PS_GetCaptionWidth
PS_GetClipCaption
PS_GetCloseOnCancel
PS_GetCurrentDataSource
PS_GetDataSourceCount
PS_GetDataSourceList
PS_GetDebug
PS_GetEnableExtCaps
PS_GetErrorCode
PS_GetErrorString
PS_GetExtInfo
PS_GetFTPPassword
PS_GetFTPUserName
PS_GetForeColor
PS_GetHAlign
PS_GetIBPP
PS_GetICompression
PS_GetIHeight
PS_GetIPixelType
PS_GetIResX
PS_GetIResY
PS_GetIWidth
PS_GetImageLayout
PS_GetManufacturer
PS_GetMaxImages
PS_GetPICPassword
PS_GetPendingXfers
PS_GetProductFamily
PS_GetProductName
PS_GetProxyServer
PS_GetSaveJPEGChromFactor
PS_GetSaveJPEGLumFactor
PS_GetSaveJPEGProgressive
PS_GetSaveJPEGSubSampling
PS_GetSaveMultiPage
PS_GetSaveTIFCompression
PS_GetShadowText
PS_GetShowUI
PS_GetTransferMode
PS_GetVAlign
PS_GetVersionInfo
PS_GethDib
PS_OpenDSM
PS_OpenSession
PS_PutCapAdvanced
PS_PutCapExtInfoCount
PS_PutCapExtInfoIndex
PS_PutCapItemOut
PS_PutCapMaxOut
PS_PutCapMinOut
PS_PutCapNumItemsOut
PS_PutCapTypeOut
PS_PutCapValueOut
PS_PutCapability
PS_PutCaption
PS_PutCaptionHeight
PS_PutCaptionLeft
PS_PutCaptionTop
PS_PutCaptionWidth
PS_PutClipCaption
PS_PutCloseOnCancel
PS_PutDebug
PS_PutEnableExtCaps
PS_PutFTPPassword
PS_PutFTPUserName
PS_PutForeColor
PS_PutHAlign
PS_PutManufacturer
PS_PutMaxImages
PS_PutPICPassword
PS_PutProductFamily
PS_PutProductName
PS_PutProxyServer
PS_PutSaveJPEGChromFactor
PS_PutSaveJPEGLumFactor
PS_PutSaveJPEGProgressive
PS_PutSaveJPEGSubSampling
PS_PutSaveMultiPage
PS_PutSaveTIFCompression
PS_PutShadowText
PS_PutShowUI
PS_PutTransferMode
PS_PutVAlign
PS_PutVersionInfo
PS_SaveFile
PS_SelectSource
PS_SetAppWindow
PS_SetCapOut
PS_SetDataSource
PS_SetImageLayout
PS_SetNotify
PS_StartSession
PS_TwnDestroy
PS_TwnInit

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7aac05df98f85de89900a0dcf683dc73

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 100KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 68KB - Virtual size: 74KB

.rsrc Size: 208KB - Virtual size: 204KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 104KB - Virtual size: 100KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 68KB - Virtual size: 74KB

.rsrc
Size: 208KB - Virtual size: 204KB

.reloc
Size: 12KB - Virtual size: 8KB