d9d9b2c6c0c9d674eb1879662ca372f0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d9d9b2c6c0c9d674eb1879662ca372f0_JaffaCakes118
Size

300KB
MD5

d9d9b2c6c0c9d674eb1879662ca372f0
SHA1

d2c1321a8121969959da22c14f8caf800d6d047a
SHA256

b8b901a8972050057d250df3f556a8d675e4fda79cca1cf92440bff63d8beba8
SHA512

5b22a0ae6172b8edc48d9dd2c486ded1148e180c6c3825bc7dea5b3363019d0e282fd91069ebb79b5490ce054ebeb3f6a3738b06dc50633de42377d070608abd
SSDEEP

6144:uysZFCVbm5MCkOB8qiSVkx50RfgPbUdamWee7NYvVyEE9u27I:n8RKCkO3ztqKdebEEQ28

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9d9b2c6c0c9d674eb1879662ca372f0_JaffaCakes118

Files

d9d9b2c6c0c9d674eb1879662ca372f0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3503d2c7b5f47b046281a49c086126ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateRemoteThread
GetVersion
OutputDebugStringA
GetStdHandle
LocalAlloc
FreeConsole
WaitForSingleObject
WriteProcessMemory
VirtualAllocEx
MultiByteToWideChar
SetLastError
GetCurrentThreadId
FileTimeToLocalFileTime
GetWindowsDirectoryA
GetSystemDefaultLangID
GetSystemInfo
OpenProcess
GetCurrentProcess
SetConsoleTextAttribute
ReadProcessMemory
GetEnvironmentVariableW
VirtualQueryEx
GlobalReAlloc
GlobalSize
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateDirectoryA
RemoveDirectoryA
MoveFileA
WideCharToMultiByte
GetExitCodeThread
GetLocalTime
SystemTimeToFileTime
GetFileAttributesA
SetFileAttributesA
Module32Next
Module32First
CopyFileA
DeleteFileA
FindClose
SetCurrentDirectoryA
FindFirstFileA
FileTimeToSystemTime
FindNextFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
UnmapViewOfFile
GetCurrentDirectoryA
CreateFileA
WinExec
FormatMessageA
GetProcessHeap
HeapAlloc
HeapFree
GetVersionExA
GetStartupInfoA
GetSystemDirectoryA
GetComputerNameA
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
WriteFile
ReadFile
Sleep
GetLastError
ExitThread
CreateThread
TerminateThread
WaitForMultipleObjects
TerminateProcess
CreatePipe
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetModuleFileNameA
GetCurrentProcessId
GlobalMemoryStatus
GetModuleHandleA
GetLogicalDrives
GetDriveTypeA
GetDiskFreeSpaceA
CreateToolhelp32Snapshot
Process32First
Process32Next
SetFileTime
MoveFileExA
lstrcmpiA
GetVolumeInformationA
CloseHandle
GetStringTypeW
GetStringTypeA
IsBadReadPtr
GetSystemTime
GetTimeZoneInformation
RaiseException
InterlockedIncrement
InterlockedDecrement
ExitProcess
RtlUnwind
CreateProcessA
LocalFree
GetOEMCP
GetCommandLineA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
DeleteCriticalSection
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
FlushFileBuffers
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
GetCPInfo
GetACP
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
HeapSize
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetFilePointer
GetExitCodeProcess
SetStdHandle
IsBadCodePtr
SetEndOfFile
CompareStringA
CompareStringW

user32

ExitWindowsEx
MessageBoxA
ClipCursor
RedrawWindow
SetWindowTextA
CloseClipboard
EmptyClipboard
OpenClipboard
GetClipboardData
GetClipCursor
DestroyIcon
GetAsyncKeyState
GetCursorPos
GetWindowTextA
GetWindowTextLengthA
CloseDesktop
CloseWindowStation
PostMessageA
SetThreadDesktop
GetDesktopWindow
EnableWindow
GetForegroundWindow
IsClipboardFormatAvailable
SetClipboardData
SendMessageA
GetKeyState
GetMessageA
OpenDesktopA
DrawTextA
GetThreadDesktop
SystemParametersInfoA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
GetUserObjectInformationA
OpenInputDesktop
ReleaseDC
GetDC
keybd_event
mouse_event
GetSystemMetrics
PostThreadMessageA

gdi32

CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetObjectA
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteObject
CreateDCA
GetDeviceCaps
SetTextColor
SetBkMode
DeleteDC
CreateFontIndirectA

advapi32

RegCloseKey
RegDeleteValueA
SetServiceStatus
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
CreateServiceA
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
ControlService
QueryServiceStatus
ChangeServiceConfigA
QueryServiceConfigA
RegisterServiceCtrlHandlerA
RegCreateKeyA
GetUserNameA
DeleteService
EnumServicesStatusExA
QueryServiceConfig2A
QueryServiceStatusEx
RegQueryInfoKeyA
RegOpenKeyA
RegEnumKeyA

shell32

SHGetFileInfoA
ShellExecuteA

ole32

CoTaskMemFree
CoInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysFreeString

iphlpapi

GetAdaptersInfo
SetTcpEntry
GetTcpTable

psapi

EnumProcessModules
GetModuleFileNameExA

ws2_32

bind
WSASocketA
sendto
__WSAFDIsSet
setsockopt
gethostname
ntohs
gethostbyname
inet_ntoa
inet_addr
connect
WSAGetLastError
WSAStartup
socket
htonl
htons
listen
accept
WSACleanup
select
recv
send
closesocket

winmm

waveInStart
waveInReset
waveInOpen
waveInClose
waveInUnprepareHeader
waveInPrepareHeader
waveOutGetNumDevs
midiOutGetNumDevs
waveOutGetDevCapsA
midiOutGetDevCapsA
PlaySoundA
mciSendStringA
waveInAddBuffer

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

netapi32

NetUserEnum
NetApiBufferFree
NetUserAdd
NetUserDel

avicap32

capGetDriverDescriptionA

msvfw32

ICCompress
ICClose
ICImageCompress
ICOpen
ICSendMessage

Exports

Exports

AddUser
DelUser
GetSysInfo
GetUser
InstallPE
InstallRT
InstallSA
InstallSB
InstallServiceA
InstallServiceB
MyConfigService
MyDeleteService
MyInstallService
MyListService
MyStartService
MyStopService
MyViewService
PEmain
PSLIST
ServiceMain
UninstallPE
UninstallRT
UninstallSA
UninstallSB
UninstallServiceA
UninstallServiceB
clonemain
nt2Kfindpass
win2003findpass

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3503d2c7b5f47b046281a49c086126ac

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

psapi

ws2_32

winmm

wininet

netapi32

avicap32

msvfw32

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 187KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 68KB - Virtual size: 1.8MB

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 188KB - Virtual size: 187KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 68KB - Virtual size: 1.8MB

.reloc
Size: 24KB - Virtual size: 21KB