dcc10bf0e9dd8d2dec3fd58e7441e645_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dcc10bf0e9dd8d2dec3fd58e7441e645_JaffaCakes118
Size

188KB
MD5

dcc10bf0e9dd8d2dec3fd58e7441e645
SHA1

cdb9bff9e825768a6e52142dfa205aaf13f5ab41
SHA256

6f40cafb341473982228e4c73352ef661aeb3b6b76751e94e16dc3fdcf29a7b4
SHA512

6031b7c8fbdb9fe4d0796ee3f103434f1e3c11588f1f38d27c667b8b174c93a69d5618531b7a1db2cba86800228f72c0adedb4287cfe2dc39c73abfbf8628482
SSDEEP

3072:E900lyZU9C4ILtAmYxu8kcVKMU3yFmnNqL9ZgQU1/3p:lPZkrIRAmL8toMUiknNggQU1/Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcc10bf0e9dd8d2dec3fd58e7441e645_JaffaCakes118

Files

dcc10bf0e9dd8d2dec3fd58e7441e645_JaffaCakes118
.dll windows:4 windows x86 arch:x86

922f387ba37d19f111feb3b15499f1a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcp60

?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

shlwapi

SHSetValueA
SHGetValueA
SHDeleteValueA

msvcrt

strtok
strftime
_mkdir
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
longjmp
__CxxLongjmpUnwind
_setjmp3
??1type_info@@UAE@XZ
wprintf
strncmp
_CxxThrowException
_stat
_strnicmp
_strlwr
time
__CxxFrameHandler
??2@YAPAXI@Z
strrchr
getenv
rand
srand
fwrite
fread
fclose
ftell
fseek
_adjust_fdiv
fopen
_access
sprintf
atoi
strstr
strncpy
malloc
free
vsprintf
mktime
localtime
_mbsnbicmp
rename
_snprintf
printf
wcscmp
memmove
sscanf
atol
wcslen
wcscat
wcscpy
isspace
abort
strchr
_stricmp

ws2_32

sendto
socket
bind
recvfrom
htons
gethostname
ntohl
inet_addr
WSAStartup
gethostbyname
ntohs

iphlpapi

GetAdaptersInfo

rasapi32

RasGetEntryDialParamsA
RasEnumEntriesA
RasEnumConnectionsA

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA

netapi32

Netbios

advapi32

GetUserNameA
LookupAccountNameA
ConvertSidToStringSidW
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
RegConnectRegistryA
RegOpenKeyA
RegEnumKeyA
StartServiceA
CreateServiceA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExW
RegQueryValueExW
OpenServiceA
ControlService
CloseServiceHandle
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumValueA

user32

GetSystemMetrics
CloseDesktop
CloseWindowStation
ReleaseDC
GetDC
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
wsprintfW
IsCharAlphaNumericA
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
SendMessageA
SetClipboardViewer
wsprintfA
ChangeClipboardChain
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
CloseClipboard
GetWindowTextA
GetForegroundWindow
GetClipboardData
OpenClipboard
GetPriorityClipboardFormat
DefWindowProcA
PostQuitMessage

oleaut32

GetErrorInfo
VariantClear
VariantInit

kernel32

CreateMutexA
GetModuleFileNameA
OutputDebugStringA
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetCurrentThreadId
GetExitCodeThread
GetSystemDirectoryW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetLogicalDrives
GetVolumeInformationA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFileAttributesA
lstrcatA
lstrcpyA
FindNextFileA
FindClose
GetWindowsDirectoryA
GetCurrentThread
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemDefaultLCID
GetEnvironmentVariableA
WideCharToMultiByte
GetPrivateProfileIntA
GetPrivateProfileStringA
InterlockedCompareExchange
WritePrivateProfileStringA
SetFilePointer
FindFirstFileA
OpenProcess
TerminateProcess
CreatePipe
GetStartupInfoA
GetVersionExA
GetSystemDirectoryA
MoveFileExA
GetModuleHandleW
TerminateThread
LocalFree
LocalAlloc
lstrlenA
SetLastError
WriteFile
CreateFileW
MultiByteToWideChar
GlobalAlloc
GetProcAddress
InterlockedIncrement
InterlockedDecrement
GetLocalTime
GetTempPathA
GetTickCount
GetCurrentProcessId
CopyFileA
DeleteFileA
MoveFileA
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
LoadLibraryA
CloseHandle
CreateProcessA
Sleep
GetLastError
InterlockedExchange
FreeLibrary
SizeofResource
LockResource
LoadResource
CreateThread
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
DeviceIoControl
GetFileSize
ReadFile
CreateFileA
SystemTimeToFileTime
FindResourceA

mfc42

ord800
ord535
ord860
ord540
ord6877
ord2818
ord858
ord924
ord4129
ord5683
ord537

gdi32

GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteObject
DeleteDC
GetPixel
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDeviceCaps

shell32

SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetPathFromIDListA

ole32

StgOpenStorage
StgIsStorageFile
CoUninitialize
CoTaskMemFree
CoInitialize
CoCreateInstance

Exports

Exports

DealA
DealB
DealC

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

922f387ba37d19f111feb3b15499f1a4

Headers

File Characteristics

Imports

msvcp60

shlwapi

msvcrt

ws2_32

iphlpapi

rasapi32

setupapi

netapi32

advapi32

user32

oleaut32

kernel32

mfc42

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 11KB - Virtual size: 40KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 11KB - Virtual size: 40KB

.reloc
Size: 10KB - Virtual size: 10KB