039712975ceca2b7bf18ea59f65f1e68_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

039712975ceca2b7bf18ea59f65f1e68_JaffaCakes118
Size

824KB
MD5

039712975ceca2b7bf18ea59f65f1e68
SHA1

58b563a102f59a5728a7d31aef1c4ebc86a9f8d0
SHA256

bb928a44a6a9d40efab5b699d7fd0716b4f302394bd664bf70049b1ad66e9095
SHA512

50b345f23c7ef82ac8b6369374985b273ce2e33a81cb5c48a09195370e1bbd77e7420edd5fb402ec6833af52c98220676883352c1aab8caa6436c2982e21771c
SSDEEP

12288:H9ho6WwDE27JmVHhMTn38YlJ/gO+usjPnbeji9z9JVPYXTmrXI2:LoGb7T1lxSu4Pnboi9q7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
039712975ceca2b7bf18ea59f65f1e68_JaffaCakes118

Files

039712975ceca2b7bf18ea59f65f1e68_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

c75abdc0c160d7edcb1b6f05dd3a9791

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

InternetOpenA
InternetGetCookieA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

kernel32

GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpA
Sleep
lstrcpyA
LoadLibraryA
GetCurrentProcessId
GetFileAttributesA
CreateDirectoryA
WaitForSingleObject
WriteFile
CreateFileA
GetTickCount
ExpandEnvironmentStringsA
WinExec
FindFirstFileA
GetTempPathA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
SetThreadLocale
FindClose
FindNextFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
CopyFileA
CompareStringA
CompareStringW
VirtualProtect
GetLongPathNameA
DisableThreadLibraryCalls
LocalFree
CreateMutexA
TlsAlloc
GetOEMCP
SetUnhandledExceptionFilter
TerminateProcess
IsBadWritePtr
VirtualFree
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
ExitProcess
GetCommandLineA
CreateThread
ResumeThread
ExitThread
GetSystemTimeAsFileTime
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapSize
HeapReAlloc
HeapDestroy
TlsGetValue
GetTimeZoneInformation
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
FlushFileBuffers
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
ReleaseMutex
lstrcatA
CreateEventA
CloseHandle
GetShortPathNameA
CreateProcessA
HeapAlloc
GetCurrentProcess
FlushInstructionCache
FreeLibrary
GetModuleFileNameA
IsDBCSLeadByte
InterlockedDecrement
InterlockedIncrement
lstrcpynA
LoadLibraryExA
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
lstrcmpiA
lstrlenA
GetProcessHeap
HeapFree
GetLastError
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsSetValue
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ReadFile
GetLocaleInfoW
SetEndOfFile
SetEnvironmentVariableA
TlsFree
LocalAlloc

user32

GetActiveWindow
GetWindowThreadProcessId
IsWindowEnabled
MessageBeep
PostMessageA
CreatePopupMenu
AppendMenuA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
IsMenu
UpdateWindow
LoadBitmapA
SetMenuItemInfoA
GetMenuItemInfoA
ModifyMenuA
GetMenuItemCount
TrackPopupMenuEx
TrackPopupMenu
DestroyMenu
InsertMenuA
CheckMenuItem
GetKeyState
RegisterClipboardFormatA
MessageBoxA
GetAncestor
EnumChildWindows
PeekMessageA
DrawTextA
MoveWindow
SetCursor
GetSystemMetrics
PtInRect
KillTimer
LoadIconA
wsprintfA
CreateWindowExA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetMessageA
CreateAcceleratorTableA
FrameRect
RedrawWindow
SetRectEmpty
EnableWindow
GetDlgItem
SetFocus
GetFocus
IsChild
DestroyAcceleratorTable
GetDesktopWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
FillRect
SetCapture
ReleaseCapture
GetSysColor
CallWindowProcA
RegisterWindowMessageA
LoadCursorA
GetWindowTextLengthA
OffsetRect
DrawEdge
InflateRect
DrawFrameControl
GetSubMenu
DestroyIcon
LoadStringA
ShowScrollBar
SetPropA
GetPropA
RemovePropA
ReplyMessage
CharUpperBuffA
CharLowerBuffA
DialogBoxParamA
CopyRect
SetTimer
EnableMenuItem
GetSysColorBrush
ScreenToClient
WindowFromPoint
GetMessagePos
CharLowerA
GetClassNameA
GetWindowDC
FindWindowExA
LoadStringW
ClientToScreen
GetWindowTextA
SetWindowTextA
DefWindowProcA
FindWindowA
WaitForInputIdle
CreateDialogParamA
GetClassInfoExA
RegisterClassExA
ShowWindow
DestroyWindow
IsWindow
SendMessageA
SetWindowLongA
EndPaint
BeginPaint
LoadImageA
UnregisterClassA
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
SetDlgItemTextA
GetWindowLongA
CharNextA
EndDialog
LoadMenuA

gdi32

CreatePatternBrush
CreateBitmap
PatBlt
CreateDIBSection
TextOutA
SetTextAlign
Rectangle
SelectClipRgn
CreateRectRgn
SetBkColor
RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCA
GetTextExtentExPointA
SetBrushOrgEx
DPtoLP
CreateFontIndirectA
CreatePen
MoveToEx
LineTo
SetTextColor
SetBkMode
CreateSolidBrush
GetStockObject
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
GetPixel
DeleteObject
GetDIBColorTable
GetObjectA
SelectObject
GetClipRgn
CreateCompatibleDC
DeleteDC

advapi32

CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
GetUserNameA

shell32

SHGetFileInfoA

ole32

StringFromGUID2
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
ReleaseStgMedium
RegisterDragDrop
CoUninitialize
CoInitialize
OleRun
OleInitialize

oleaut32

GetErrorInfo
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
DispCallFunc
VarBstrCmp
SysAllocStringByteLen
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysAllocString
SysAllocStringLen
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysFreeString

shlwapi

SHDeleteKeyA
SHGetValueA
PathRemoveFileSpecA
PathAddBackslashA
PathFileExistsA
PathFindExtensionA

msimg32

AlphaBlend
TransparentBlt

winmm

PlaySoundA

Exports

Exports

AlertEntryPoint
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ExpLoadFromLocalResources
ExpMakeLocalResources
ExpSendLog
NewsEntryPoint

Sections

.text
Size: 524KB - Virtual size: 523KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ShareDat
Size: 4KB - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c75abdc0c160d7edcb1b6f05dd3a9791

Headers

File Characteristics

Imports

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msimg32

winmm

Exports

Exports

Sections

.text Size: 524KB - Virtual size: 523KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 12KB - Virtual size: 24KB

ShareDat Size: 4KB - Virtual size: 552B

.rsrc Size: 160KB - Virtual size: 156KB

.reloc Size: 44KB - Virtual size: 40KB

.text
Size: 524KB - Virtual size: 523KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 12KB - Virtual size: 24KB

ShareDat
Size: 4KB - Virtual size: 552B

.rsrc
Size: 160KB - Virtual size: 156KB

.reloc
Size: 44KB - Virtual size: 40KB