c24b80288e9d97bf1ecadb2b90ad1082_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c24b80288e9d97bf1ecadb2b90ad1082_JaffaCakes118
Size

58KB
MD5

c24b80288e9d97bf1ecadb2b90ad1082
SHA1

b5c8c4aafcfdaf5c1f0afc4b92e2df921e448946
SHA256

9799416256225113e5f367629227e26defc83ce77b5d76eedfa9a972e291566c
SHA512

aa48ec69e342d628e274d0552e3367665a20de14fd90005230881d06a17a9a0134485064a8cbbe770251dd93a7efd341df69c40df363bfb62015cdd72a3f13d1
SSDEEP

1536:We6Q1wjsCSGphJzPZW2pBG2Bv6Ul6hesCfPQlO5Bc:WeNqjsCSGphJNJ1IU86fPPBc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c24b80288e9d97bf1ecadb2b90ad1082_JaffaCakes118

Files

c24b80288e9d97bf1ecadb2b90ad1082_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b7d82f31e87ac0d4b854b38e4ccc28ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetOpenA

ws2_32

recv
setsockopt
send
connect
socket
htons
inet_ntoa
gethostbyname
inet_addr
WSAStartup
closesocket

psapi

GetModuleFileNameExA

gdiplus

GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDeleteGraphics
GdipCreateBitmapFromGdiDib
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipSaveImageToStream
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateBitmapFromScan0

mfc42

ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord3262
ord3136
ord4465
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord3178
ord3010
ord3790
ord356
ord2770
ord1980
ord2781
ord1116
ord4058
ord3181
ord800
ord3319
ord3310
ord668
ord6385
ord5773
ord354
ord5186
ord3318
ord5442
ord1979
ord665
ord823
ord825
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord3259

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
atoi
fseek
fread
fopen
fwrite
fclose
getenv
strlen
memcmp
malloc
wcscmp
free
memset
__CxxFrameHandler
_beginthread
abs
memcpy
strchr
strrchr
strcmp
strcpy
sprintf

kernel32

GlobalAlloc
GlobalUnlock
GlobalLock
ReadFile
GetOEMCP
WriteFile
DuplicateHandle
Process32Next
OpenProcess
lstrcatA
GetVolumeInformationA
SetStdHandle
GetDriveTypeA
GetDiskFreeSpaceExA
MoveFileA
CreateDirectoryA
SetEvent
WaitForSingleObject
DeleteFileA
CloseHandle
CreateEventA
GlobalFree
lstrcpyA
GetTickCount
GetLastError
GetSystemDirectoryA
GetCurrentProcessId
GetLocalTime
GetComputerNameA
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
GetVersion
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
lstrcmpA
LocalFree
LocalAlloc
TerminateProcess
CreateToolhelp32Snapshot
Process32First
GetCurrentProcess
Sleep
CreatePipe
GetStdHandle
GetModuleFileNameA
CreateProcessA
GetLogicalDriveStringsA
lstrlenA

user32

GetKeyboardState
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowTextA
GetActiveWindow
ExitWindowsEx
ToAscii
CharUpperA
OpenInputDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
PostMessageA
SetCursorPos
SendInput
IsWindow
SendMessageA
DispatchMessageA
GetMessageA
wsprintfA
DestroyWindow

gdi32

GetCurrentObject
CreateDCA
GetDeviceCaps
DeleteDC

advapi32

CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
StartServiceA
ControlService
DeleteService
EnumServicesStatusA
QueryServiceConfigA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
QueryServiceStatus
CreateServiceA
ImpersonateSelf
OpenThreadToken
RegCreateKeyExA
RegSetValueExA

shell32

SHEmptyRecycleBinA
ShellExecuteA
SHFileOperationA

ole32

CreateStreamOnHGlobal

avicap32

capCreateCaptureWindowA

Exports

Exports

LoadProfile
ServiceMain
TestFunc

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7d82f31e87ac0d4b854b38e4ccc28ca

Headers

File Characteristics

Imports

wininet

ws2_32

psapi

gdiplus

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

avicap32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 5KB

Share Size: 4KB - Virtual size: 8B

.rsrc Size: 4KB - Virtual size: 16B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 5KB

Share
Size: 4KB - Virtual size: 8B

.rsrc
Size: 4KB - Virtual size: 16B

.reloc
Size: 4KB - Virtual size: 2KB