dd031debb1d9b67642bb3087c46ee4e6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dd031debb1d9b67642bb3087c46ee4e6_JaffaCakes118
Size

132KB
MD5

dd031debb1d9b67642bb3087c46ee4e6
SHA1

eee7d91fa14aafe0680c186879ae0f9add34b432
SHA256

3799d4361195d864962bb78a55c557af4692d05be77eeee7de9262bc06c367ba
SHA512

6f97f581f18f9bd3ed1b811207ada387f306454f4206ea396deb683d741e936176e59286cf42adaa6094a84fcbb288bbf9a50b9c3ddecde496ea3ef5dc279d36
SSDEEP

1536:euidnPFXiEZtVemmm50RUd0+jw8U4GDdNNj31XjP7w1ZakHQhwW65ULOHjOql4Ld:TidVrmm509+GN1aakzC6HjOqlBl5M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd031debb1d9b67642bb3087c46ee4e6_JaffaCakes118

Files

dd031debb1d9b67642bb3087c46ee4e6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e048e8c1cfe6a3847280bb8208ad0c7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Work\7.14\vipshell\VipShell\Release\VipShell.pdb

Imports

kernel32

WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
OpenProcess
FreeLibrary
LoadLibraryW
CreateMutexW
GetModuleFileNameA
GetCurrentThreadId
WriteFile
PeekNamedPipe
CreateProcessW
GetSystemDirectoryW
GetStartupInfoW
CreatePipe
GetTempPathW
GetModuleFileNameW
GetWindowsDirectoryW
GlobalMemoryStatus
GetCurrentProcess
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeThread
VirtualFree
MultiByteToWideChar
lstrlenA
CreateThread
DeleteFileW
CopyFileW
GetComputerNameW
SetEvent
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile
GetStringTypeW
GetStringTypeA
GetDiskFreeSpaceExW
FlushFileBuffers
SetStdHandle
IsBadCodePtr
ReadProcessMemory
GetCPInfo
GetOEMCP
LoadLibraryA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
HeapSize
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
HeapCreate
HeapDestroy
GetModuleHandleA
TlsGetValue
TlsSetValue
TlsFree
SetLastError
CreateDirectoryW
MoveFileA
CreateProcessA
InterlockedExchange
ReadFile
CreateFileW
GetFileSize
CloseHandle
lstrcpyW
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
TlsAlloc
VirtualQuery
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
ExitProcess
VirtualFreeEx
WideCharToMultiByte
GetLastError
Sleep
GetModuleHandleW
CreateEventW
lstrlenW
lstrcatW
FindFirstFileW
FindNextFileW
FindClose
IsBadReadPtr
GetDriveTypeW
GetLocaleInfoA
GetACP

user32

TranslateMessage
GetMessageW
CreateWindowExW
IsWindow
SendMessageW
GetDesktopWindow
RegisterClassW
DispatchMessageW
LoadIconW
GetAsyncKeyState
GetKeyState
GetForegroundWindow
mouse_event
SetCursorPos
keybd_event
KillTimer
SetTimer
LoadCursorW
DefWindowProcW
GetWindowThreadProcessId
GetWindowLongW
MessageBoxA
GetSystemMetrics
CloseWindowStation
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
wsprintfW
FindWindowW
PostMessageW
RegisterWindowMessageW
SendMessageTimeoutW
GetClassNameW
GetCursor
IsRectEmpty
GetDC
ReleaseDC
GetWindowTextA
EnumChildWindows

advapi32

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
ChangeServiceConfigW
CreateServiceW
OpenServiceW
CloseServiceHandle
ControlService
OpenSCManagerW
RegCloseKey

ole32

CoInitialize

shell32

SHFileOperationW
ShellExecuteA

oleaut32

VariantInit
VariantClear
SysFreeString

ws2_32

ntohl
inet_addr
send
ntohs
select
getpeername
recv
closesocket
WSAStartup
htonl
htons
connect
socket
inet_ntoa
gethostbyname

avicap32

capGetDriverDescriptionW
capCreateCaptureWindowW

gdi32

GetStockObject
GetDIBits
RealizePalette
SelectPalette
GetObjectW
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject

psapi

EnumProcessModules
GetModuleFileNameExW

wininet

InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile

Exports

Exports

DownCtrlAltDel
GetDllModuleControl
StartServer
WaitServer

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.VipShel
Size: 4KB - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e048e8c1cfe6a3847280bb8208ad0c7a

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

ws2_32

avicap32

gdi32

psapi

wininet

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 8KB - Virtual size: 12KB

.VipShel Size: 4KB - Virtual size: 520B

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 12KB

.VipShel
Size: 4KB - Virtual size: 520B

.reloc
Size: 12KB - Virtual size: 8KB