0fe38a0fe46fb49bad510fbbf12dc3ec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0fe38a0fe46fb49bad510fbbf12dc3ec_JaffaCakes118
Size

220KB
MD5

0fe38a0fe46fb49bad510fbbf12dc3ec
SHA1

ffca059e6b1b4a15366483c701ffd5109f931378
SHA256

a3651f3400486ce730d60ad56aa7eac6d0b2caa85ad1c16a8ad6ac3d02531e11
SHA512

86e1db99a7c0e095362f486f81071a8302907d0ea9022607694b2c9c0b1b7fc8ce98550e7b8a0017d409a41a6c6e3c1850ef71ce19b905608826e2970419962b
SSDEEP

3072:9iwEKaskj23BljN9FN3CCA9GWhEkxyZwAd4Hdc2AIKslfL//2PZFdHDxGF:9iwoPy3BljXON9TSkxx84oI/OPZC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fe38a0fe46fb49bad510fbbf12dc3ec_JaffaCakes118

Files

0fe38a0fe46fb49bad510fbbf12dc3ec_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

d04f3845052a94e2f458f656c5a57e45

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

eraser

eraserStop
eraserProgGetPercent
eraserProgGetTotalPercent
eraserProgGetCurrentPass
eraserProgGetPasses
eraserProgGetTimeLeft
eraserProgGetCurrentDataString
eraserProgGetMessage
eraserDispFlags
eraserIsValidContext
eraserCreateContext
eraserSetDataType
eraserAddItem
eraserSetWindow
eraserSetWindowMessage
eraserStart
eraserFailedCount
eraserErrorStringCount
eraserShowReport
eraserCompleted
eraserDestroyContext
eraserRemoveFolder
eraserEnd
eraserInit
eraserShowOptions

kernel32

VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
ExitProcess
HeapReAlloc
TerminateProcess
HeapSize
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapFree
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
FileTimeToSystemTime
FindClose
FindFirstFileA
LocalFree
FormatMessageA
GetFileAttributesA
GetDriveTypeA
lstrlenA
MultiByteToWideChar
lstrcpynA
GetLastError
CopyFileA
CreateDirectoryA
FindNextFileA
SetLastError
GetVersion
lstrcmpiA
lstrlenW
DeleteFileW
FreeResource
GlobalFree
HeapAlloc
RtlUnwind
GetShortPathNameA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GlobalFlags
RaiseException
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
GlobalUnlock
CloseHandle
GetCurrentThread
lstrcmpA
GetModuleFileNameA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
GetModuleHandleA
GetProcAddress
InterlockedDecrement
MulDiv
GlobalAlloc
GlobalLock
GetSystemTimeAsFileTime

user32

DestroyIcon
DestroyMenu
LoadCursorA
GetSysColorBrush
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
ShowWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetMessageTime
GetMessagePos
LoadIconA
PeekMessageA
MapWindowPoints
MessageBoxA
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
PostMessageA
AdjustWindowRectEx
GetClassInfoA
SendMessageA
GetClientRect
TranslateAcceleratorA
EnableWindow
LoadAcceleratorsA
InsertMenuA
IsWindow
EndDialog
GetNextDlgTabItem
RegisterClassA
UnregisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
wsprintfA
GetWindowTextLengthA
GetWindowTextA
GetWindow
SetFocus
GetSysColor
EndPaint
BeginPaint
ReleaseDC
GetTopWindow
GetParent
IsWindowEnabled
GetDlgItem
GetWindowLongA
DestroyWindow
CreateDialogIndirectParamA
GetSystemMetrics
SetActiveWindow
GetActiveWindow
GetDesktopWindow
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
TabbedTextOutA
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA

gdi32

GetObjectA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
GetTextExtentPoint32A

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueA
RegOpenKeyA
RegEnumKeyA
RegQueryValueA

shell32

DragQueryFileA
SHGetPathFromIDListA
SHChangeNotify
ExtractIconA
SHGetFileInfoA

comctl32

ord17

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

CoTaskMemFree
ReleaseStgMedium
StringFromCLSID
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectObject

oleaut32

SysFreeString
SystemTimeToVariantTime
VarBstrFromDate
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SysAllocString
LoadTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d04f3845052a94e2f458f656c5a57e45

Headers

File Characteristics

Imports

eraser

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 28KB - Virtual size: 27KB