ce4a99cab1118e8f89fa0b541c7bc2a8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ce4a99cab1118e8f89fa0b541c7bc2a8_JaffaCakes118
Size

196KB
MD5

ce4a99cab1118e8f89fa0b541c7bc2a8
SHA1

09b4d967fbaa6ac574e8e07f25a0ab2d78af8544
SHA256

83bcbed72e933dc8f5c291022767e973cc53061643090699526f9fa99ae14bfe
SHA512

072d64a8a8602053565cb859330ff05fc0b019b9c945e0213cd3170b0c99c9f6f573b75769bc73d71fe0264446c8a9e18fddf32ca5165dfe5eb15ed5bb269e51
SSDEEP

1536:aecouJ10PNZFu8L1skFwFQaD1B3ZvIsgTwrpaf185J/Gbhcohs7Q2LUHLtDA+A:G1WNZFuC1DgD1zIn1EJ/GbhcohX6Urv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce4a99cab1118e8f89fa0b541c7bc2a8_JaffaCakes118

Files

ce4a99cab1118e8f89fa0b541c7bc2a8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

cfdc2945e1a28208a98b48481f6d5dba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

VirtualQuery
GlobalLock
GlobalAlloc
SetFileAttributesA
IsDBCSLeadByte
GetCommandLineA
CreateFileA
lstrcmpiA
GetLastError
DeleteFileA
RemoveDirectoryA
WaitForSingleObject
CreateProcessA
GetShortPathNameA
WritePrivateProfileStringA
GetWindowsDirectoryA
MoveFileExA
OutputDebugStringA
GetExitCodeProcess
OpenProcess
Sleep
GetTickCount
GetCurrentProcessId
ReadFile
SetFilePointer
CopyFileA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemTime
_lclose
_llseek
CloseHandle
MultiByteToWideChar
CreateMutexA
GetTempFileNameA
GetTempPathA
ReleaseMutex
WriteFile
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetEnvironmentVariableA
GetVersion
GetSystemDirectoryA
FlushFileBuffers
SetEndOfFile
GetFileSize
SetCurrentDirectoryA
GetCurrentDirectoryA
InterlockedExchange
GlobalFindAtomA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GlobalFree
GlobalUnlock
GlobalHandle
lstrcmpA
CompareStringA
GetFileAttributesA
GetLocalTime
lstrcatA
FindFirstFileA
FindNextFileA
FindClose
GetVersionExA
lstrcpyA
lstrlenA
_lread
_lopen
SetLastError
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
SetStdHandle
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapAlloc
LCMapStringW
LCMapStringA
WideCharToMultiByte
GetOEMCP
GetACP
GetCPInfo
ExitProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapFree
InterlockedIncrement
InterlockedDecrement
RtlUnwind

user32

SetDlgItemTextA
LoadStringA
wsprintfA
IsWindow
CharToOemA
OemToCharA
CharPrevA
wvsprintfA
MessageBoxA
CharNextA
DialogBoxParamA
EndDialog
GetSystemMetrics
EnableWindow
SetTimer
KillTimer
GetDC
ReleaseDC
SetPropA
GetPropA
DestroyWindow
SetWindowPos
GetParent
SendDlgItemMessageA
GetDlgItem
InvalidateRect
CreateDialogParamA
SetWindowTextA
IsIconic
BringWindowToTop
ShowWindow
GetKeyboardType
SendMessageA
FindWindowA
RegisterWindowMessageA
PostMessageA
SetWindowsHookExA
UnhookWindowsHookEx
PeekMessageA
TranslateMessage
PostQuitMessage
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
CallNextHookEx
GetWindowRect
SystemParametersInfoA
DispatchMessageA
EnumWindows

gdi32

GetStockObject

advapi32

RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegEnumValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyA

shell32

SHBrowseForFolderA
SHGetMalloc
SHFileOperationA
SHGetPathFromIDListA
SHGetSpecialFolderLocation

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Exports

Exports

BackupRegistry
CreateInternetShortcut
CreateNAVMutex
CreateProcessAndWait
FindandFixupCNTFiles
FixUpNECConfigSys
FridayScan
GetBootDir
GetFileVersionString
GetLatestVirusDefDir
GetNavStartInfo
GetOSBuildNumber
GetUsageCount
InstallVBox
IsAVProductInstalled
IsFileLoaded
IsIE4orGreater
IsMSTaskInstalled
IsOEMPersonalityDLL
IsScheduleRunning
LaunchSetupWithProgress
MachineIsNEC
MyCharToOem
ReleaseNAVMutex
RemoveAPUI
RemoveLine
RemoveQConsole
RemoveSched
RemoveScheduledScans
SWLaunchSetupAndWait
SWMove55CleanupTasks
SetInocDirRegEntry
SetNavStartInfo
SetUpNAVDXTrialInfo
ShellBrowseFolder
ShutdownApps
StringContainsDBCSChars
StringContainsHiAsciiChars
UninstInitialize
UninstUnInitialize
UninstallVirusDefinitions
UpdateEastEuropeanAutoexec

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfdc2945e1a28208a98b48481f6d5dba

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 92KB - Virtual size: 98KB

.shared Size: 4KB - Virtual size: 16B

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 92KB - Virtual size: 98KB

.shared
Size: 4KB - Virtual size: 16B

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 8KB - Virtual size: 7KB