027f0afc3ba1a769052b12233918ec79_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

027f0afc3ba1a769052b12233918ec79_JaffaCakes118
Size

260KB
MD5

027f0afc3ba1a769052b12233918ec79
SHA1

1fc4406b3bddee73c15b04244d965da44f236e83
SHA256

bc9eb27dcf4e3ea37c1210204d082622ad237e5a84c6939427c82bbb0ece7508
SHA512

91ac7acd56a5a56b8fa2b7f6c7cf71913ea26b57f4826b7014a9a2d016828700d7f129330c03012db013b057bfa4461cd65b04e98d828d12ccd52ceb510c31c0
SSDEEP

6144:9HcV3AX0pcSgtXMTyzZouDtbwTjHvkrbywh1Mcamm:KAX0pcZXeyWu8qbykBm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
027f0afc3ba1a769052b12233918ec79_JaffaCakes118

Files

027f0afc3ba1a769052b12233918ec79_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1546f99fec9d9abb887acf56e8835a4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
CreateThread
GetTickCount
SystemTimeToFileTime
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetModuleFileNameW
LocalFree
CreateEventW
SetEvent
Sleep
LeaveCriticalSection
EnterCriticalSection
ResetEvent
OpenEventW
UnmapViewOfFile
RaiseException
MapViewOfFile
CreateFileMappingW
lstrcpynA
lstrlenA
MultiByteToWideChar
IsBadReadPtr
SetWaitableTimer
CancelWaitableTimer
GetLastError
CreateWaitableTimerW
OpenWaitableTimerW
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
GetModuleHandleA
ExitProcess
DisableThreadLibraryCalls
FreeLibraryAndExitThread
TerminateThread
GetVersionExW
GetCurrentThread
lstrcatA
GetSystemTimeAsFileTime
lstrcmpiW
lstrcmpW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
OutputDebugStringA
SetEndOfFile
WriteFile
VirtualProtect
SetLastError
lstrcmpiA
lstrcpyA
GetVolumeInformationW
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTime
GetCurrentProcessId
WaitForMultipleObjects
FlushFileBuffers
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
VirtualQuery
Thread32Next
Thread32First
SuspendThread
ResumeThread
OpenThread
GetLongPathNameA
GetSystemInfo
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetFileSize
ReadFile
WideCharToMultiByte
MoveFileW
lstrcatW
GetLocalTime
ReleaseMutex
CreateMutexW
WaitForSingleObject
GetCurrentProcess
lstrcpyW
FreeLibrary
lstrlenW
lstrcpynW
CreateProcessW
CloseHandle
SetErrorMode
GetFileAttributesW
LoadLibraryA
GetProcAddress
OutputDebugStringW
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetOEMCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

DispatchMessageW
PeekMessageW
BroadcastSystemMessageW
MsgWaitForMultipleObjectsEx
IsCharAlphaW
IsCharAlphaNumericW
UpdateWindow
SendMessageW
FindWindowExW
wsprintfW
SetWindowTextW
UnregisterClassA
SetForegroundWindow
TranslateMessage
AllowSetForegroundWindow
wsprintfA
LockSetForegroundWindow
SetWindowsHookExW
PostMessageW
MsgWaitForMultipleObjects
CallNextHookEx
UnhookWindowsHookEx
EnumChildWindows

advapi32

DuplicateTokenEx
SetNamedSecurityInfoW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegFlushKey
RegNotifyChangeKeyValue
ImpersonateSelf
OpenProcessToken
GetLengthSid
SetTokenInformation
SetThreadToken
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

shell32

ord680
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

OleRun
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoFreeUnusedLibraries

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
VariantCopy
GetErrorInfo
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen

shlwapi

UrlEscapeW
StrStrIA
StrRStrIW
StrCmpNW
UrlUnescapeW
StrStrIW

ntdll

RtlZeroMemory
RtlUnwind

Exports

Exports

Startup
e
l
r

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1546f99fec9d9abb887acf56e8835a4d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 179KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 12KB - Virtual size: 37KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 180KB - Virtual size: 179KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 37KB

.reloc
Size: 16KB - Virtual size: 15KB