d6956f44043dd138d8f1a920fa91cd5f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d6956f44043dd138d8f1a920fa91cd5f_JaffaCakes118
Size

276KB
MD5

d6956f44043dd138d8f1a920fa91cd5f
SHA1

957cf009307ccfac0d5e0fab671d2c8988ead2d4
SHA256

ec77c1f559f917c90647d14d07c1c4f35a6daee1687d1d22aa17bbcb3f751082
SHA512

6260c5ed4a23e2897f22c1af98165ace5dd63189e3bcbab44d4af6470453de26c0b0b1ecfea10ec27fecc4e13e0b9b3f5c8491d1c989416c2489677dab1882b5
SSDEEP

3072:32T3/LGL7bqM9cALVcIFtGEfXCTP3so5phDWgd8dI6:mT3/LGjvc0Xe2CTP3TphDJd8n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6956f44043dd138d8f1a920fa91cd5f_JaffaCakes118

Files

d6956f44043dd138d8f1a920fa91cd5f_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

3d7184750fd0a5b2909e466421f7cf7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetSetFilePointer
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
InternetOpenA
FindFirstUrlCacheEntryA

comctl32

ord17
CreateToolbarEx

kernel32

WritePrivateProfileStringA
GetPrivateProfileStringA
WritePrivateProfileSectionA
GetPrivateProfileSectionA
WriteFile
DeleteFileA
lstrcpyW
CopyFileA
SetFilePointer
GetFileSize
CreateFileA
ReleaseMutex
MoveFileExA
Sleep
CreateMutexA
GetLocalTime
GetPrivateProfileIntA
CreateDirectoryA
GetSystemDirectoryA
CompareStringA
CompareStringW
InterlockedDecrement
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetStringTypeW
GetStringTypeA
OpenFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStdHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LCMapStringW
LCMapStringA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
InterlockedIncrement
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
VirtualAlloc
ReadFile
ResumeThread
ExitThread
MoveFileA
RaiseException
GetSystemTimeAsFileTime
RtlUnwind
HeapAlloc
HeapReAlloc
HeapFree
FindFirstFileA
FindClose
CreateProcessA
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
lstrlenA
lstrcpyA
lstrcatA
CreateThread
WaitForSingleObject
CloseHandle
FlushFileBuffers
SetStdHandle
GetLastError
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
LocalFree
InitializeCriticalSection
GetConsoleMode
GetConsoleCP

user32

LoadBitmapA
SetWindowTextW
MoveWindow
GetDlgCtrlID
TranslateMessage
DispatchMessageA
ClientToScreen
TrackPopupMenuEx
MapVirtualKeyA
keybd_event
GetClassInfoA
RegisterClassA
GetWindowRect
GetParent
CreateWindowExA
SetWindowLongA
DefWindowProcA
GetWindowTextLengthA
SetWindowTextA
GetDC
ReleaseDC
GetClientRect
GetSysColorBrush
FillRect
SetCursor
LoadCursorA
TrackMouseEvent
CallWindowProcA
GetSysColor
wsprintfA
SendMessageA
DrawTextA
GetWindowTextA
GetCursorPos
ScreenToClient
ChildWindowFromPoint
SetCapture
InvalidateRect
AppendMenuA
CreatePopupMenu
BeginPaint
SetTimer
KillTimer
EndPaint
SetFocus
IsWindowVisible
IsWindow
ReleaseCapture
DestroyMenu
ShowWindow
GetWindowLongA
DestroyWindow

advapi32

RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey

ole32

StringFromIID
CoGetMalloc

shell32

ShellExecuteA
SHGetSpecialFolderPathA

oleaut32

SysAllocStringLen
SysStringLen
VarBstrCat
SysFreeString
VariantClear
SysAllocString

shlwapi

StrStrIA

ws2_32

socket
WSAStartup
htons
closesocket
sendto
inet_addr

msimg32

TransparentBlt

gdi32

LineTo
CreateRoundRectRgn
MoveToEx
DeleteObject
SetTextColor
GetTextMetricsA
SetBkMode
CreateFontIndirectA
GetTextExtentPoint32A
SelectObject
CreateCompatibleDC
GetStockObject
GetTextColor
CreatePen
DeleteDC
GetObjectA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d7184750fd0a5b2909e466421f7cf7c

Headers

File Characteristics

Imports

wininet

comctl32

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

ws2_32

msimg32

gdi32

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 116KB - Virtual size: 113KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 116KB - Virtual size: 113KB

.reloc
Size: 12KB - Virtual size: 10KB