cf83a098d42124baa2cabd637223c8d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cf83a098d42124baa2cabd637223c8d4_JaffaCakes118
Size

296KB
MD5

cf83a098d42124baa2cabd637223c8d4
SHA1

8e2e8cf4030b36c4a75079ae24ff9b96f62c4fa3
SHA256

ab26f5324af7de768977a4d21ae6b42015f4c6f69e0f505f7975cbb32c0835e7
SHA512

647cb0e1f3c5d6958dfd6b08e02d81b5f9a19bbe79586915e6f647fdd194b6f4238e57b139cf0457f41cb0898f73bdf3171ec1042b2a77cdb16b38fc03bd275e
SSDEEP

3072:ZUhTdiDEB2NENS+wYTlfa5pEhP6cQ2OGebmn3GSV1XK4eWG2tT/wmITmHRx8:EJiDV4JwYipEhkXe3GSV1XKxiYpeRx8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf83a098d42124baa2cabd637223c8d4_JaffaCakes118

Files

cf83a098d42124baa2cabd637223c8d4_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

dfa43c8db5fb79f3f81d04be1d15dd05

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
CreateThread
CloseHandle
CreateProcessA
GetTempPathA
GetCurrentThreadId
lstrcmpA
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
MulDiv
SetLastError
VirtualAlloc
GetProcAddress
LoadLibraryA
IsBadReadPtr
VirtualProtect
VirtualFree
HeapFree
GetProcessHeap
HeapAlloc
VirtualQuery
GetCurrentProcessId
LockResource
GetProcessId
DisableThreadLibraryCalls
SetThreadLocale
GetThreadLocale
WaitForSingleObject
ReadFile
SetFilePointer
CreateFileA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetCurrentDirectoryA
GetFullPathNameA
GetConsoleMode
GetConsoleCP
HeapSize
EnterCriticalSection
LCMapStringA
GetOEMCP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetCommandLineA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
HeapReAlloc
RtlUnwind
GetSystemInfo
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InterlockedCompareExchange
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
LocalFree
GetModuleFileNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetModuleHandleA
GetStringTypeW
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
IsDBCSLeadByte
InterlockedDecrement
InterlockedIncrement
Sleep
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeA

user32

SetTimer
KillTimer
CreateAcceleratorTableA
IsWindow
GetDesktopWindow
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcA
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
UnregisterClassA
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
SetWindowPos
MoveWindow
GetSysColor
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DefWindowProcA
SendMessageA
DestroyWindow
CreateWindowExA
GetWindowLongA
SetWindowLongA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetActiveWindow
GetFocus
GetSystemMetrics
ShowWindow
wsprintfA
SetForegroundWindow
SetActiveWindow
SetFocus
CharNextA
GetParent

ole32

OleInitialize
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

urlmon

CoInternetGetSession

advapi32

RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA

oleaut32

SysStringByteLen
OleCreateFontIndirect
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantClear
VariantInit
VarUI4FromStr
SysFreeString
SysAllocStringLen

gdi32

CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
DeleteObject
GetObjectA
GetStockObject
SelectObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 200KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfa43c8db5fb79f3f81d04be1d15dd05

Headers

File Characteristics

Imports

kernel32

user32

ole32

urlmon

advapi32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 200KB - Virtual size: 198KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 28KB - Virtual size: 33KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 200KB - Virtual size: 198KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 28KB - Virtual size: 33KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 20KB - Virtual size: 19KB