d9ca158f4d006afff9074d14da8d995b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d9ca158f4d006afff9074d14da8d995b_JaffaCakes118
Size

188KB
MD5

d9ca158f4d006afff9074d14da8d995b
SHA1

1d17718942d65e6073bf2a772aaa0afe67b9c532
SHA256

0d9cff2c7e54c27ed52fa38a5f33d22017e8ef2660fb3c82cbbe33cc81159b96
SHA512

0bd4af1d94f6308afea65bde6d1b5091072e8a5061461a3dd2396582ffeb33da7cbd08b5b2854e19727f6df80b82782751498cfff1dc48191e9cd3677b005008
SSDEEP

3072:gK460/P66ZCbtAqMXdmCZcLI4s2dPJ6Fgvx3ADbVyZGoq7rwinyzV/3Q9:gDnq6ZGtAqM7OI4h1QO3WyZC7+V/3Q9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9ca158f4d006afff9074d14da8d995b_JaffaCakes118

Files

d9ca158f4d006afff9074d14da8d995b_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

5d00bf7d3241b1fab8cfb1a101876f6b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

webvw.pdb

Imports

msvcrt

free
realloc
malloc
_except_handler3

kernel32

VirtualAlloc
VirtualFree
HeapAlloc
GetProcessHeap
HeapFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
GetShortPathNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
DisableThreadLibraryCalls
DeleteFileW
GlobalLock
GlobalUnlock
GetModuleFileNameW
lstrcatW
HeapDestroy
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
lstrcpyW
GetModuleHandleW
LocalFree
LocalAlloc
GetFileAttributesW
lstrcpynW
SetFileAttributesW
GetWindowsDirectoryW
GetLastError
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
GlobalAlloc
GlobalFree
SystemTimeToFileTime
GetUserDefaultLCID
LoadLibraryA
lstrlenW
GetProcAddress
FreeLibrary
LoadLibraryW
InterlockedExchange
MultiByteToWideChar

gdi32

CreateMetaFileW
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
CreateDCW
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
RestoreDC
GetStockObject
Rectangle
GetNearestColor
GetDIBits
SetDIBits
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
SelectPalette
RealizePalette
BitBlt
SetStretchBltMode
StretchBlt
GetTextFaceW
GetTextMetricsW
CreateFontW
SetTextColor
SetBkColor
TextOutW
GetObjectW
CreateBitmapIndirect
GetTextExtentPointW
CreateFontIndirectW
Ellipse
Pie
CreatePen
SelectObject
Arc
MoveToEx
LineTo
CreateEllipticRgnIndirect
CreateRectRgn
OffsetRgn
CombineRgn
CreateSolidBrush
FillRgn
DeleteObject

user32

OffsetRect
EqualRect
IntersectRect
EndPaint
GetClientRect
BeginPaint
CallWindowProcW
IsWindow
SetWindowRgn
SetWindowPos
UnionRect
CharNextW
RegisterClassExW
ReleaseDC
UnregisterClassW
CreatePopupMenu
GetMenuDefaultItem
ClientToScreen
TrackPopupMenu
DestroyMenu
DestroyIcon
GetIconInfo
RegisterClassW
GetParent
wsprintfW
GetWindowLongW
DefWindowProcW
LoadCursorW
GetClassInfoExW
SetWindowLongW
DrawIconEx
DrawFocusRect
SystemParametersInfoW
InvalidateRect
DestroyAcceleratorTable
ShowWindow
GetFocus
IsChild
SetFocus
DestroyWindow
InvalidateRgn
RegisterClipboardFormatW
CreateWindowExW
GetMenuItemInfoW
DeleteMenu
GetMenuItemCount
DispatchMessageW
GetSystemMetrics
SetRect
MapWindowPoints
SetCapture
GetCapture
PeekMessageW
CallMsgFilterW
ReleaseCapture
TranslateMessage
PtInRect
WaitMessage
PostMessageW
LoadStringW
GetSysColor
GetDC
GetKeyState

advapi32

RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
CreateOleAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SafeArrayCreateVector
VariantInit
SysAllocString
SysAllocStringLen
SysStringLen
VariantClear
VariantTimeToSystemTime
OleTranslateColor
LoadRegTypeLi
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
OleCreatePropertyFrame
SysFreeString

shlwapi

ord157
ord476
ord437
StrCatBuffW
PathFileExistsW
ord488
ord172
ord217
StrCmpW
ord158
PathFindExtensionW
StrCmpIW
StrRetToBufW
PathIsUNCW
PathIsRootW
StrChrIW
StrStrIW
StrFormatByteSizeW
ord354
StrPBrkW
wnsprintfW
StrChrW
StrToIntExW
StrRetToStrW
ord176
SHCreateShellPalette
ord174
PathAppendW
PathRemoveFileSpecW
SHRegisterValidateTemplate
PathIsDirectoryW
PathMakeSystemFolderW
ord69
ord346
StrCpyNW

shdocvw

ord218

shell32

SHGetSpecialFolderLocation
ord155
ord100
ord239
SHGetMalloc
ord18
SHBindToParent
SHGetPathFromIDListW
ord71
ord77
ord195
ord196
ShellExecuteExW
ord88
SHGetFolderPathW
ord16
SHGetDesktopFolder
ord152
ord17
ord28

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d00bf7d3241b1fab8cfb1a101876f6b

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

gdi32

user32

advapi32

ole32

oleaut32

shlwapi

shdocvw

shell32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 100KB

.data Size: 57KB - Virtual size: 57KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 100KB - Virtual size: 100KB

.data
Size: 57KB - Virtual size: 57KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 5KB - Virtual size: 5KB