fb0aa955481d3bc776358db53c4e08bf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fb0aa955481d3bc776358db53c4e08bf_JaffaCakes118
Size

640KB
MD5

fb0aa955481d3bc776358db53c4e08bf
SHA1

21c7f9c4a9b6382520e048b4c5f2c61102029e44
SHA256

810c0325f63b6bac8557f7956535e924a58a6fb69e7e197a340bbdbe54a5ccd3
SHA512

c5151ce949d2796812a63f3bf202f7fcc7229fd8858a3d24cb9db022c9d2ca958d3fbd734b87199c3f817b636b5fa09acb58b16aa66b025a8329788f8916e11b
SSDEEP

12288:4Dr3dgCwuJBmjIaO4W7d5+g8ZgT1lG4VvJxbPLYKpXP25+2kN0gVLLl98QH3HmA:4Dr3dEuJBmhO4icg8ZgT1lG4lJxbjmG8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb0aa955481d3bc776358db53c4e08bf_JaffaCakes118

Files

fb0aa955481d3bc776358db53c4e08bf_JaffaCakes118
.dll windows:4 windows x86 arch:x86

637f66271f6396068d6d3548c3010b5e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

Process32First
GetTempPathA
FindNextFileA
RemoveDirectoryA
GetPrivateProfileStringA
Sleep
MoveFileExA
HeapFree
HeapAlloc
GetProcessHeap
WriteFile
ReadFile
CreateDirectoryA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalFree
GlobalAlloc
GetLocalTime
Process32Next
GetFileAttributesA
lstrlenA
lstrcatA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
SetFilePointer
SystemTimeToFileTime
GetCurrentDirectoryA
FileTimeToSystemTime
GetFileInformationByHandle
GetTickCount
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
GetProcAddress
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetEnvironmentStringsW
GetEnvironmentStrings
CreateToolhelp32Snapshot
Module32First
Module32Next
GetWindowsDirectoryA
GetSystemDirectoryA
OpenProcess
TerminateProcess
WaitForSingleObject
CreateFileA
GetLongPathNameA
FindFirstFileA
FindClose
SetFileAttributesA
WinExec
GetModuleFileNameA
DeleteFileA
SetEnvironmentVariableA
GetCurrentProcess
CloseHandle
lstrcmpiA
GetVersionExA
GetStdHandle
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
GetFileSize
GetLastError
SetEndOfFile
GetLocaleInfoW
lstrcpyA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
SetUnhandledExceptionFilter
GetStartupInfoA
SetHandleCount
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleHandleA
GetOEMCP
GetACP
HeapSize
TlsGetValue
SetLastError
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
RtlUnwind
HeapReAlloc
SetStdHandle
GetFileType
ExitProcess
RaiseException
GetTimeZoneInformation
GetSystemTime
MoveFileA
GetCommandLineA
GetVersion
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree

user32

FindWindowA
SendMessageA
MessageBoxA
CharUpperA
CharLowerA
GetWindowLongA
GetDesktopWindow
wsprintfA
GetWindow

advapi32

RegDeleteKeyA
RegQueryInfoKeyA
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
CopySid
AddAce
RegCreateKeyA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
FreeSid
RegEnumValueA
RegEnumKeyExA
RegEnumKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
GetTokenInformation
LookupAccountSidA
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA

shell32

SHFileOperationA
SHGetSpecialFolderPathA
SHEmptyRecycleBinA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysAllocStringLen
SysFreeString

netapi32

NetApiBufferFree
NetQueryDisplayInformation

wininet

FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry

shlwapi

SHDeleteKeyA

Exports

Exports

AdwareRepair
ClearAutoForm
ClearCookie
ClearHistory
ClearIECache
ClearMediaPlayLog
ClearRecent
ClearRecycleBin
ClearRunList
ClearSearchComputerAndPeople
ClearSearchFileFolder
ClearSearchInternet
ClearSearchPictureAndMusicAndVideo
ClearSiteVisitedLog
ClearTemp
ClearWinTemp
DeepScan
EngineInit
EngineRealTimeInit
FailedRepair
GetBoombList
GetRestartAVmon
GetRestoreCount
GetScanCurrentCount
GetScanCurrentPos
InitObj
OptInit
OptRelease
Quarantine
QuarantinePow
Quarantine_Close
Quarantine_Create
Quarantine_Restore
Quarantine_RestoreInit
QuickAdRepair
Release
Repair
Scan
StartInit
xmlInitialize

Sections

.text
Size: 500KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

637f66271f6396068d6d3548c3010b5e

Headers

File Characteristics

Imports

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

netapi32

wininet

shlwapi

Exports

Exports

Sections

.text Size: 500KB - Virtual size: 497KB

.rdata Size: 60KB - Virtual size: 56KB

.data Size: 36KB - Virtual size: 63KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 32KB - Virtual size: 29KB

.text
Size: 500KB - Virtual size: 497KB

.rdata
Size: 60KB - Virtual size: 56KB

.data
Size: 36KB - Virtual size: 63KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 32KB - Virtual size: 29KB