d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118
Size

277KB
MD5

d742d6eadc49e0b21e94706fc098ebb9
SHA1

76ddcb8eb5f6e1c0a884f311b85287eee993e6f6
SHA256

c7657ad732a6bdfc44bceba1f9df9ce3343cf45a084b2f53a9d46ac437b150a5
SHA512

7c3dbdbcf0cef81b52d3d45f08fdae5aac2b9e8d28f8535c1f291e1e60123c0b037d17e8d79f29f8d3e9bc2601e0ad40c5a3ea97d4393c997a9bac1ddae3ef75
SSDEEP

6144:ayL6YDiSCRPfBiQ0QmTkc01NeG4GVRDe7jdrTcc:a+LDiHBkRueDGHDskc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118

Files

d742d6eadc49e0b21e94706fc098ebb9_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

71bcb4efe9ba0ea6a8e63f4c76df52d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

iepeers.pdb

Imports

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
wcstol
wcschr
_wcsicmp
free
malloc
__dllonexit
_wcsnicmp
_ltow
_purecall
_vsnwprintf
??2@YAPAXI@Z
bsearch
wcsncmp
memset
memcpy
memmove
realloc
_unlock
_lock
_onexit
_XcptFilter
_wtoi
??3@YAXPAX@Z

kernel32

LocalAlloc
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
InitializeCriticalSectionAndSpinCount
SetLastError
FindResourceExW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SearchPathW
CreateActCtxW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetProcAddress
LoadLibraryW
GetLocaleInfoW
MulDiv
GlobalUnlock
GlobalLock
LocalFree
GetDiskFreeSpaceA
WriteFile
GetSystemTimeAsFileTime
GetLastError
InterlockedDecrement
InterlockedIncrement
FileTimeToSystemTime
SystemTimeToFileTime
CompareStringW
LoadLibraryA
GetModuleFileNameA
GetFullPathNameA
SearchPathA
LoadLibraryExA
GetVersionExW
GetModuleFileNameW
lstrlenW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
FreeLibrary
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
DisableThreadLibraryCalls
GetUserDefaultLCID
GlobalAlloc
GlobalFree
CompareFileTime

advapi32

GetUserNameW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW

shlwapi

ord437
StrCmpW
ord418
PathAddBackslashW
SHRegGetValueW
StrCpyW
ord176
ord158
ord2
StrCmpIW
StrCpyNW
PathFindFileNameW
ord156
wnsprintfW
PathCombineA
PathAppendA
StrCmpNIW
StrDupW
SHGetValueW

ole32

CreateBindCtx
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal

oleaut32

SafeArrayPutElement
SafeArrayCreate
SysFreeString
VariantClear
SysStringLen
VariantInit
SysAllocString
SafeArrayCreateVector
SysAllocStringLen
VariantChangeTypeEx
VariantCopy
VarI4FromStr
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi

gdi32

EndPage
StartDocW
EndDoc
CreateICW
GetDeviceCaps
SetViewportOrgEx
AbortDoc
StartPage
DeleteDC
CreateDCW

user32

GetDesktopWindow
CharNextW
MessageBoxW
LoadStringW

urlmon

FaultInIEFeature
CoInternetParseUrl
CreateUri
CoInternetCombineUrlEx
RegisterBindStatusCallback
CoInternetCreateSecurityManager

wininet

CreateUrlCacheContainerA
InternetCombineUrlW
InternetQueryOptionW
InternetGetConnectedStateExW
RetrieveUrlCacheEntryStreamW
GetUrlCacheEntryInfoW
FindCloseUrlCache
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCrackUrlW
CommitUrlCacheEntryW
CreateUrlCacheEntryW
UnlockUrlCacheEntryStream
ReadUrlCacheEntryStream
DeleteUrlCacheEntryW

shell32

ord25
SHGetFolderPathA
ord152
ord155
SHGetDesktopFolder

winspool.drv

OpenPrinterW
GetPrinterW
DocumentPropertiesW
DeviceCapabilitiesW
ClosePrinter

iertutil

ord32
ord309
ord58
ord166
ord163

Exports

Exports

DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

71bcb4efe9ba0ea6a8e63f4c76df52d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

shlwapi

ole32

oleaut32

gdi32

user32

urlmon

wininet

shell32

winspool.drv

iertutil

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 118KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 6KB - Virtual size: 6KB

.text Size: 97KB - Virtual size: 100KB

.text
Size: 119KB - Virtual size: 118KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 97KB - Virtual size: 100KB