dcb82a355078b26c03bc74fa0340fb3c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dcb82a355078b26c03bc74fa0340fb3c_JaffaCakes118
Size

69KB
MD5

dcb82a355078b26c03bc74fa0340fb3c
SHA1

1e7ac888ff855268c37765074ea8493f2c08b6a2
SHA256

c3bbd6e09b22b45d009665bf66c96cdb12351174b36941fee3194394b56b0795
SHA512

917d15b00eb2fbacd1a83ac477d20bb64de59e299d0b7a29ad5bfa3731516a843b8753f16fb0fa81513ae704e866e8ca320a12ab758e2e5be1e13779acadb703
SSDEEP

1536:eNkE2JzPpj2Q9go9A/Aow7maaRTlp9KT2eSjD:sYzhjFgogw7yv9KT2eY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcb82a355078b26c03bc74fa0340fb3c_JaffaCakes118

Files

dcb82a355078b26c03bc74fa0340fb3c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

79e8b47b5eb6f2c2c36a86cfc832025a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr71

strchr
memcpy
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_CxxThrowException
__CxxFrameHandler
atoi
sprintf
??3@YAXPAX@Z
??_V@YAXPAX@Z
wcslen
memcmp
??_U@YAPAXI@Z
_stricmp
strncpy
strlen
free
malloc
memset
_except_handler3
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
_strupr
fclose
strpbrk
strrchr
fopen
fgets
isalnum
strcmp
strcspn
_strnicmp
memmove
_itoa
_purecall
time
_strlwr
strncat
strcat
_strcmpi
strcpy
strstr
??2@YAPAXI@Z

ws2_32

gethostbyname
gethostname
accept
connect
WSAStartup
htonl
select
htons
listen
send
closesocket
__WSAFDIsSet
socket
bind
recv
WSACleanup
shutdown
getsockname

kernel32

MultiByteToWideChar
GetTickCount
Sleep
GetUserDefaultLCID
GetVersion
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileSectionNamesA
LocalFree
FindNextFileA
FindClose
FindFirstFileA
GetVolumeInformationA
GetWindowsDirectoryA
ExpandEnvironmentStringsA
GetComputerNameA
GetExitCodeThread
DeleteCriticalSection
CreateToolhelp32Snapshot
WaitForMultipleObjects
OpenEventA
Process32Next
ResetEvent
EnterCriticalSection
FreeLibraryAndExitThread
LeaveCriticalSection
InitializeCriticalSection
Process32First
CreateProcessA
GetTempPathA
GetFileTime
GetLocalTime
SystemTimeToTzSpecificLocalTime
OpenProcess
lstrcpyA
lstrcpynA
lstrlenA
GetVersionExA
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GetLocaleInfoA
GetCurrentProcessId
DuplicateHandle
CreateFileA
GetFileSize
lstrcmpA
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
WaitForSingleObject
SetEvent
FlushViewOfFile
WriteFile
TerminateThread
CreateEventA
ReadFile
GetSystemDirectoryA
lstrcatA
SetThreadPriority
GetLastError
OpenMutexA
CreateFileMappingA
CreateMutexA
ReleaseMutex
CloseHandle
CreateThread
SystemTimeToFileTime
CompareFileTime
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentThread
SetLastError
GetProcAddress
DisableThreadLibraryCalls
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetConnectA
InternetOpenUrlA

user32

SetWindowsHookExA
CallNextHookEx
DispatchMessageA
TranslateMessage
wsprintfA
PostThreadMessageA
GetMessageA
SendMessageTimeoutA
SendMessageA
RegisterClassA
DefWindowProcA
CreateWindowExA
PostQuitMessage
DestroyWindow
FindWindowExA
LoadStringA
EnumWindows
GetWindow
ShowWindow
GetDlgItem
UnhookWindowsHookEx
GetWindowThreadProcessId
FindWindowA

advapi32

RevertToSelf
RegEnumKeyExA
RegEnumKeyA
RegQueryInfoKeyA
RegOpenKeyA
RegQueryValueExA
ImpersonateLoggedOnUser
OpenProcessToken
RegCloseKey
GetUserNameA
RegOpenKeyExA

ole32

OleUninitialize
OleInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

VariantCopy
VariantInit
SysFreeString
SysAllocString
GetErrorInfo
VariantClear

Exports

Exports

?RemoteFreeLibrary@@YAHPAUHWND__@@PAUHINSTANCE__@@K@Z
?RemoteFreeLibraryO@@YAHPAUHWND__@@PAUHINSTANCE__@@K@Z
?RemoteGetModuleHandleA@@YAPAUHINSTANCE__@@PAUHWND__@@PBDK@Z
?RemoteGetModuleHandleAO@@YAPAUHINSTANCE__@@PAUHWND__@@PBDK@Z
?RemoteLoadLibraryA@@YAPAUHINSTANCE__@@PAUHWND__@@PBDK@Z
FixMode
switch_func

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79e8b47b5eb6f2c2c36a86cfc832025a

Headers

File Characteristics

Imports

msvcr71

ws2_32

kernel32

wininet

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 59KB - Virtual size: 59KB

.data Size: 1KB - Virtual size: 72KB

.shared Size: 1024B - Virtual size: 664B

.rsrc Size: 1024B - Virtual size: 584B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 59KB - Virtual size: 59KB

.data
Size: 1KB - Virtual size: 72KB

.shared
Size: 1024B - Virtual size: 664B

.rsrc
Size: 1024B - Virtual size: 584B

.reloc
Size: 5KB - Virtual size: 4KB