f5f17b64bc4d08ebede25f23259f4f6b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f5f17b64bc4d08ebede25f23259f4f6b_JaffaCakes118
Size

192KB
MD5

f5f17b64bc4d08ebede25f23259f4f6b
SHA1

b87a8cba109614902f20155cfa6c763164172bbd
SHA256

5a2736756c469e74faf115d4346bc0e60dbd311f46606417abe5bba61219385e
SHA512

897e5e5c241db8d56e7ada16c6596bc2ba7174072d3ccee9b268630cb1b6a8f51b91c919f0f03a09999d45f09f2ed9d2a9e520e1e9625cb2b9d48a9f5c561ea2
SSDEEP

3072:31ZQSyJKnXGcdoN4OlRid4AHBXdDqaTYy35JQRlaInnPCzCHXw4EnCN:a4HON4OlRiRfFr5WRlPPCzIXw/C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5f17b64bc4d08ebede25f23259f4f6b_JaffaCakes118

Files

f5f17b64bc4d08ebede25f23259f4f6b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

18ef8cbf5a3195e50bb106a542603de7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
InterlockedExchange
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
LocalFree
LocalAlloc
GetTickCount
lstrcpyA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
OutputDebugStringA
FreeLibrary
SetErrorMode
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
IsDBCSLeadByte
GetModuleFileNameA
DisableThreadLibraryCalls
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
LoadLibraryA

user32

ShowWindow
ReleaseDC
GetDC
ScreenToClient
GetClientRect
GetWindowRect
SetWindowPos
GetWindowTextA
GetWindowThreadProcessId
SendMessageA
SetWindowLongA
CharNextA
CreateDialogParamA
PostMessageA
DefWindowProcA
GetWindowLongA
IsIconic
wsprintfA
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
SetWindowTextA
GetWindowTextLengthA
CreateWindowExA
DestroyWindow
GetSystemMetrics
IsWindow
GetDlgItem
EnableWindow
UnregisterClassA

gdi32

GetStockObject
SelectObject
GetTextExtentPoint32A

advapi32

RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
DispCallFunc
VariantInit
VariantCopy
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
VariantClear
SysFreeString
SysStringLen

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr80

__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
?terminate@@YAXXZ
_except_handler4_common
toupper
_chdrive
_chdir
_getcwd
_mbsrchr
_invalid_parameter_noinfo
calloc
_recalloc
_purecall
_resetstkoflw
??_V@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memset
wcsncpy_s
strcpy_s
_CxxThrowException
memcpy_s
free
malloc
_mbsnbcpy_s
memcmp
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
strcat_s
??3@YAXPAX@Z
__clean_type_info_names_internal

Exports

Exports

?COMWndProc@@YGJPAUHWND__@@IIJ@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18ef8cbf5a3195e50bb106a542603de7

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 108KB - Virtual size: 106KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 108KB - Virtual size: 106KB

.reloc
Size: 8KB - Virtual size: 5KB