eb40a2b50c8adcf1208508264eca45df_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eb40a2b50c8adcf1208508264eca45df_JaffaCakes118
Size

92KB
MD5

eb40a2b50c8adcf1208508264eca45df
SHA1

a4da3bd94b29827890701b3b46d1a8573b0dd984
SHA256

249e97c6f2c048365b0623b23de770ffe053765c3c1c09c010e77b1d6ee58b97
SHA512

a761cd93623752df4c654cc9b23b93c5fb181f4980c8bf995352ef4657988b90edb648e82ac82369f4bbe9b6c31363ceff3ffb2169bd1b9ab80fc9c34c510ca5
SSDEEP

1536:K9wDFK2ervA1qcG5NbTZ7kcwuhj8y1yR9ZxCnVEAK8Qw62b7t6UxL3JgrcCN:jDt241qpzbF7kcwun14CVfQ8bkU/g4e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb40a2b50c8adcf1208508264eca45df_JaffaCakes118

Files

eb40a2b50c8adcf1208508264eca45df_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c9f6f7f821053123fa740edde1f9b741

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
GetCurrentProcess
Sleep
SetUnhandledExceptionFilter
SetLastError
CreateEventW
FreeLibrary
lstrcmpW
SetEvent
WaitForSingleObject
GetOverlappedResult
CancelIo
ReadFile
UnhandledExceptionFilter
RaiseException
GetProcAddress
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
FindClose
FindNextFileW
FindFirstFileW
HeapAlloc
lstrcatW
lstrlenW
lstrcpyW
OpenEventW
GetVolumeNameForVolumeMountPointW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
DeleteFileW
LoadLibraryExW
ResetEvent
WriteFile
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcpynW
lstrcmpiW
CreateFileW
CreateFileA
VirtualProtect
lstrcmpiA
GetVersionExA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
HeapDestroy
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetLastError
GetProcessHeap
HeapFree
DisableThreadLibraryCalls
GetTickCount
GetCommandLineA
LoadLibraryW

user32

wsprintfW
LoadStringW
GetSystemMetrics
CreateWindowExA
CallWindowProcW
SetFocus
DestroyWindow
CharNextW
ShowWindow

advapi32

RegDeleteValueW
RegOpenKeyExW
ChangeServiceConfigW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
FreeSid
RegOpenKeyW
AllocateAndInitializeSid
CheckTokenMembership
RegQueryValueExA
RegOpenKeyExA
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CloseServiceHandle
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteKeyA

gdi32

CreateDCA
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
SaveDC
SetWindowOrgEx
RestoreDC
GetDeviceCaps
CreateDCW

ole32

OleRun
CreateBindCtx
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

rpcrt4

NdrClientCall2
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree

msvcrt

_wtol
memcpy
_CxxThrowException
_callnewh
ldiv
memset
_wcsicmp
wcsncmp
_initterm
_adjust_fdiv
??3@YAXPAX@Z
__CxxFrameHandler
_except_handler3
_wcsnicmp
wcschr
wcscmp
malloc
wcslen
wcsncpy
free
realloc

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9f6f7f821053123fa740edde1f9b741

Headers

File Characteristics

Imports

kernel32

user32

advapi32

gdi32

ole32

rpcrt4

msvcrt

msvcp60

Sections

.text Size: 47KB - Virtual size: 47KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 1KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 1KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB