bcef5d8c99dfb4ac14cc898827c91eab_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bcef5d8c99dfb4ac14cc898827c91eab_JaffaCakes118
Size

97KB
MD5

bcef5d8c99dfb4ac14cc898827c91eab
SHA1

9131b2a2cf3f6b6a906ba5c3148c081ff0cc633e
SHA256

944f8a5569c80d42e8df01184b21d342bedef76388192dc9c752ace9b01320b6
SHA512

db2771924deba144ba00ee2a626dd55c3bc83ba23bafe3f35a766689dc970786e2797f648d9281d7d7e0adf494fb5a92da76ac5240320260e1326a4743cf4e4b
SSDEEP

1536:cWm87ytfN03gzQk1sLEGGi9Ubi+fFawRuCOuIs6n2bc/IwOXa8i:cnAy70QckaQI9Ci4F4C9Is9w/IwOX0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcef5d8c99dfb4ac14cc898827c91eab_JaffaCakes118

Files

bcef5d8c99dfb4ac14cc898827c91eab_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

96ed93020a0f3ec9b87e5554a7e44252

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetFileSize
CreateFileMappingA
MoveFileExA
HeapReAlloc
HeapFree
DebugBreak
GetSystemInfo
HeapAlloc
DisableThreadLibraryCalls
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapCreate
GetModuleHandleA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
InitializeCriticalSection
lstrlenW
MapViewOfFile
FlushInstructionCache
Sleep
_lcreat
RemoveDirectoryA
FindNextFileA
DeleteFileA
InterlockedExchange
GetExitCodeProcess
GetTickCount
GetCurrentProcessId
UnmapViewOfFile
SetFilePointer
GetTempFileNameA
GetTempPathA
CreateDirectoryA
GetLocalTime
WriteFile
GetEnvironmentVariableA
_llseek
_lwrite
_lclose
LocalFree
WaitForSingleObject
SetEndOfFile
GetSystemDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
LoadLibraryA
FreeLibrary
MultiByteToWideChar
GetShortPathNameA
FindFirstFileA
FindClose
CopyFileA
CreateSemaphoreA
GetLastError
lstrcmpA
GetWindowsDirectoryA
lstrcatA
CreateProcessA
CloseHandle
GetModuleFileNameA
lstrlenA
LocalAlloc
lstrcpyA
WideCharToMultiByte
lstrcmpiA
GetCurrentThread
GetCurrentProcess
GetVersionExA
_lopen
_lread
CompareFileTime
GetSystemTimeAsFileTime
HeapDestroy
GetProcAddress
GetCurrentThreadId

user32

MsgWaitForMultipleObjects
SendMessageA
BeginPaint
EndPaint
WaitMessage
DispatchMessageA
GetDC
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
IsWindow
ReleaseDC
UpdateWindow
DestroyWindow
GetClassInfoExA
LoadCursorA
RegisterClassExA
CharNextA
CallWindowProcA
GetWindowLongA
SetWindowLongA
UnionRect
PtInRect
GetKeyState
DefWindowProcA
MessageBoxA
wsprintfA
TranslateMessage
PeekMessageA
SetTimer
ShowWindow
RegisterClassA
ValidateRect
PostQuitMessage
KillTimer
GetFocus
IsChild
CreateWindowExA
GetClientRect

gdi32

SetTextAlign
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
Rectangle
RestoreDC
TextOutA
CreateRectRgnIndirect

advapi32

SetSecurityDescriptorGroup
RegCloseKey
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegOpenKeyExA
FreeSid
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
ImpersonateSelf
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA

ole32

OleSaveToStream
WriteClassStm
OleLoadFromStream
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

LoadTypeLi
RegisterTypeLi
SysStringLen
SysAllocStringLen
VarUI4FromStr
VariantClear
VariantChangeType
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
LoadRegTypeLi

ws2_32

WSCUnInstallNameSpace
WSCInstallNameSpace
WSACleanup
WSAGetLastError
WSAStartup
WSASetLastError
WSALookupServiceBeginW
WSALookupServiceNextW
WSALookupServiceEnd
closesocket
htons
WSASocketA
ntohs
WSAIoctl
WSCDeinstallProvider
WSCEnumProtocols
WSCGetProviderPath
WSCInstallProvider

wininet

InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NSPStartup
NewDotNetInstall
NewDotNetStartup
NewDotNetUninstall
WSPStartup
_Java_TLDApplet_getVersion@8
_Java_TLDApplet_install__Ljava_lang_String_2@12
_Java_TLDInstall_install@8

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96ed93020a0f3ec9b87e5554a7e44252

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

wininet

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 60KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 12KB - Virtual size: 12KB

.shared Size: 4KB - Virtual size: 8B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 64KB - Virtual size: 60KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 12KB - Virtual size: 12KB

.shared
Size: 4KB - Virtual size: 8B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 4KB