eee29d12bcd84b8210334c790e08f294_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eee29d12bcd84b8210334c790e08f294_JaffaCakes118
Size

252KB
MD5

eee29d12bcd84b8210334c790e08f294
SHA1

e31bb3eaa220bf280067427e2e67ac378707cb9c
SHA256

06d2f94bfcf6c0f1ed9ecfee99a8c136f69d72305af92f9ae3b6ed7555058e66
SHA512

3e500329ebc3c32c16a578ddbb5c12f8a721986ffad84849bca74b03c8b1342ffa86d94630e28b51cdf7cbdf71ba2bfbd6f2203802f8eae9be1a7f5100da64d1
SSDEEP

6144:pULvEgcO4DrmfnFSRrIFqriGrkLQpp1sHSe:GL1bPzq+K8QpO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eee29d12bcd84b8210334c790e08f294_JaffaCakes118

Files

eee29d12bcd84b8210334c790e08f294_JaffaCakes118
.dll windows:4 windows x86 arch:x86

bd3f37a1cfeb5bc2cae61624d161c2b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

GetTokenInformation
LookupPrivilegeNameA
OpenProcessToken
OpenThreadToken
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueA
RegQueryValueExA
RegSetValueExA

user32

UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TabbedTextOutA
SystemParametersInfoA
ShowWindow
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowLongA
SetPropA
SetMenuItemBitmaps
SetForegroundWindow
SetCursor
SendMessageA
RemovePropA
ReleaseDC
RegisterWindowMessageA
RegisterClassA
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
ModifyMenuA
MessageBoxA
MapWindowPoints
LoadIconA
LoadCursorA
LoadBitmapA
IsWindowVisible
IsWindowEnabled
IsWindow
IsIconic
GrayStringA
GetWindowThreadProcessId
GetWindowTextA
ValidateRect
GetWindowPlacement
GetWindowLongA
GetWindow
GetTopWindow
GetSystemMetrics
GetSysColorBrush
GetSysColor
GetSubMenu
GetPropA
GetParent
GetMessageTime
GetMessagePos
GetMessageA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuCheckMarkDimensions
GetMenu
GetLastActivePopup
GetKeyState
GetForegroundWindow
GetFocus
GetDlgItem
GetDlgCtrlID
GetDC
GetCursorPos
GetClientRect
GetClassNameA
GetClassLongA
GetClassInfoExA
GetClassInfoA
GetCapture
GetActiveWindow
EnableWindow
EnableMenuItem
DrawTextExA
DrawTextA
DispatchMessageA
DestroyWindow
DestroyMenu
DefWindowProcA
CreateWindowExA
CopyRect
ClientToScreen
CheckMenuItem
CharUpperA
CallWindowProcA
CallNextHookEx
AdjustWindowRectEx
WinHelpA
GetWindowRect

oleaut32

VariantChangeType
VariantInit
VariantClear

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status_Ex
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

kernel32

lstrlenA
lstrcmpW
lstrcmpA
lstrcatA
WritePrivateProfileStringA
WriteFile
WriteConsoleW
WriteConsoleA
WideCharToMultiByte
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
TerminateProcess
Sleep
SizeofResource
SetUnhandledExceptionFilter
SetStdHandle
SetLastError
SetHandleCount
SetFilePointer
SetErrorMode
RtlUnwind
ReadFile
RaiseException
QueryPerformanceCounter
MultiByteToWideChar
LockResource
LocalReAlloc
LocalFree
LocalAlloc
LoadResource
LoadLibraryA
LeaveCriticalSection
LCMapStringW
LCMapStringA
IsValidCodePage
IsDebuggerPresent
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InitializeCriticalSection
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalGetAtomNameA
GlobalFree
GlobalFlags
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetWindowsDirectoryA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetSystemTimeAsFileTime
GetStringTypeW
GetStringTypeA
GetStdHandle
GetStartupInfoA
GetProcessHeap
GetProcAddress
GetOEMCP
GetModuleHandleA
GetModuleFileNameW
CloseHandle
CompareStringA
ConvertDefaultLocale
CreateFileA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
EnumResourceLanguagesA
ExitProcess
FindResourceA
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsA
GetEnvironmentStringsW
GetFileSize
GetFileType
GetLastError
GetLocaleInfoA
GetModuleFileNameA

gdi32

TextOutA
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
SetTextColor
SetMapMode
SetBkColor
SelectObject
ScaleWindowExtEx
ScaleViewportExtEx
SaveDC
RestoreDC
RectVisible
PtVisible
OffsetViewportOrgEx
GetStockObject
GetDeviceCaps
GetClipBox
ExtTextOutA
Escape
DeleteObject
DeleteDC
CreateBitmap

shlwapi

PathFindFileNameA
PathFindExtensionA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

Exports

Exports

AudioGetFormatInfo
BAOCloseHandle
CopyStrmPrmToRawObj
CreateBlockAccessFromImage
DVDPRVRRestoreVideoRecording
EnumMCCustomItemDataRelease
GLMapBufferObject
GLRegisterBufferObject
GetBaseImageDataPropertyCount
GetDriveModeCount
GetVMSInfo
IsSupportParamItem
MallocArray
Memcpy3D
OpenDevice
RegisterDriveChangeCallback
WGLGetDevice

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd3f37a1cfeb5bc2cae61624d161c2b1

Headers

File Characteristics

Imports

advapi32

user32

oleaut32

setupapi

kernel32

gdi32

shlwapi

winspool.drv

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 144KB

.data Size: 96KB - Virtual size: 136KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 144KB - Virtual size: 144KB

.data
Size: 96KB - Virtual size: 136KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB