1205d8009fabb84ac729be6b3673f384_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1205d8009fabb84ac729be6b3673f384_JaffaCakes118
Size

242KB
MD5

1205d8009fabb84ac729be6b3673f384
SHA1

4bc59ad8ff125437e4f0ef69a703213852718e7c
SHA256

019d82b2179345f54ab8b4bc7e9617e34af5f7c831af835f11a40901dc9ff41b
SHA512

adc825ec350bda2426c3f695984e43fc42d26f66068373bb2c4dc1726218c2d065ff9ae9de20b02a74d3a62033c5e2c7143e5af0601dfec2ec5ebe1ecd492839
SSDEEP

6144:qZnGbGb7i+64AWHWSx5w834ElSsQKamPdadgZhflG1JCsZvbx:qZn6GPJ64AWWGMbmladgZRlK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1205d8009fabb84ac729be6b3673f384_JaffaCakes118

Files

1205d8009fabb84ac729be6b3673f384_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

bc11084130986de527077989fb159794

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

UrlGetPartW
StrStrIA
StrCmpIW
UrlEscapeW
SHRegSetUSValueW
SHSetValueW
SHDeleteValueW
SHGetValueW
SHDeleteKeyW
StrStrIW
PathStripPathW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

MapAndLoad
UnMapAndLoad

wininet

InternetQueryOptionA
InternetOpenW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestW

urlmon

URLDownloadToFileW
UrlMkGetSessionOption

rpcrt4

UuidToStringW
RpcStringFreeW

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

kernel32

RtlUnwind
HeapFree
HeapAlloc
InitializeCriticalSectionAndSpinCount
GetSystemTime
CreateEventW
CloseHandle
OpenProcess
TerminateProcess
OpenMutexW
WaitForSingleObject
CreateProcessW
SetEvent
CreateMutexW
GetCommandLineW
ExitProcess
CreateThread
ExitThread
Sleep
GetModuleFileNameW
lstrlenW
lstrcpyW
DeleteFileW
lstrcpynA
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
FreeLibrary
IsBadReadPtr
VirtualProtect
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
GlobalFree
ResetEvent
MoveFileExW
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetTempFileNameW
GetTickCount
LocalAlloc
LocalFree
GetLastError
GetLocalTime
SystemTimeToFileTime
VirtualQuery
GetSystemInfo
GetSystemWindowsDirectoryW
GetVolumeInformationW
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WriteFile
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
GetCurrentProcessId
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
ResumeThread
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
RaiseException
HeapDestroy
HeapCreate
GetEnvironmentStringsW
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
GetEnvironmentVariableW
GetCommandLineA
IsDebuggerPresent
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsValidCodePage

user32

CharLowerW
GetWindowThreadProcessId
PostMessageW
SetWindowTextW
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
CharUpperW
GetClassNameW
EnumChildWindows
OffsetRect
ClientToScreen
DispatchMessageW

advapi32

SetNamedSecurityInfoW
DeleteAce
GetAce
GetNamedSecurityInfoW
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
CryptDecrypt
CryptDestroyKey
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
CryptImportKey
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegDeleteKeyW
RegQueryValueW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyW
RegSetValueW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW

ole32

OleInitialize
OleUninitialize
CoTaskMemFree
CLSIDFromString
CoCreateInstance

oleaut32

SysStringLen
SysFreeString
VariantInit
VariantClear
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
SysAllocStringByteLen
SysAllocString
SysStringByteLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMProcedure
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc11084130986de527077989fb159794

Headers

File Characteristics

Imports

shlwapi

version

imagehlp

wininet

urlmon

rpcrt4

crypt32

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 178KB - Virtual size: 177KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 192B

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 178KB - Virtual size: 177KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 192B

.reloc
Size: 14KB - Virtual size: 13KB