2654c3c15568cc5a17b5356e5bae88c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2654c3c15568cc5a17b5356e5bae88c7_JaffaCakes118
Size

128KB
MD5

2654c3c15568cc5a17b5356e5bae88c7
SHA1

73d3c140b7e8d4c6d01675b9f2ffe2365d6f2b2f
SHA256

f54d414779886ec11b40a27a3d90152072519050149ddbbfe3f01ffc2afd1f19
SHA512

18f37577698132e8c8ed864f59b127db4eb1ee102c34ad992fcfb3ff39257f81fabe757b78252d1edbe772294a88216f7bd7acfbe3eb8de4dffa570937ce3ce4
SSDEEP

3072:r59+9TGz4dPsoduPknaJ1KDBJS1wWD2OyHh1A:CiKsodk14JywOWh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2654c3c15568cc5a17b5356e5bae88c7_JaffaCakes118

Files

2654c3c15568cc5a17b5356e5bae88c7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d8ccebe37658fb2ee2c5242c4748d31b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VerLanguageNameW
GlobalAddAtomW
GetHandleInformation
IsDebuggerPresent
GetProcessHeap
GetVersion
ClearCommBreak
SetFileApisToANSI
ReadProcessMemory
GetModuleHandleA
WriteConsoleW
DeleteFileA
GetOverlappedResult
CloseHandle
VerLanguageNameA
GetCurrencyFormatW
IsValidLocale
GetProcAddress
ReadConsoleInputExW
LoadLibraryA
ExpandEnvironmentStringsA
GetCurrentDirectoryA
GetSystemTime
GetUserDefaultLCID
SleepEx
TerminateJobObject
GetVDMCurrentDirectories
GetComputerNameA
VirtualAlloc

user32

GetWindowWord
UnregisterHotKey
GetClassWord
GetUserObjectInformationA
ChangeClipboardChain
RedrawWindow
SetMessageExtraInfo
GetClassLongA
EnumThreadWindows
ScrollWindowEx
SetClassWord
BeginPaint
GetOpenClipboardWindow
EnableScrollBar
DdeQueryConvInfo
DrawFrame
DrawStateA
CreateCaret
GetClassNameW
ToAsciiEx
ChangeDisplaySettingsExW
CallMsgFilterW
DlgDirSelectComboBoxExW
DdeAddData
EnumDisplaySettingsW
PeekMessageA
SetProcessDefaultLayout
UpdateWindow
SetWindowLongA
SetThreadDesktop
MessageBoxIndirectA
CharToOemBuffW
SetWindowPos
EnumWindowStationsA
DialogBoxIndirectParamA
GetForegroundWindow
GetNextDlgGroupItem
GrayStringA
GetIconInfo
mouse_event

gdi32

SetTextAlign
GetBkColor
SetTextJustification
GetTextCharacterExtra

advapi32

SystemFunction031
CryptDuplicateKey
SystemFunction006
ConvertAccessToSecurityDescriptorW
ElfRegisterEventSourceW
PrivilegeCheck

comctl32

ImageList_SetDragCursorImage
ord14
ord6
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Copy
ImageList_Create
ord16
ImageList_DrawIndirect
CreatePropertySheetPageW
FlatSB_SetScrollPos
ImageList_DragEnter
ImageList_Read
ord7
ImageList_Remove
_TrackMouseEvent
DestroyPropertySheetPage
FlatSB_EnableScrollBar
FlatSB_SetScrollRange
ord17
ImageList_SetIconSize
ImageList_DrawEx
InitCommonControlsEx
ord5
ImageList_AddMasked
FlatSB_SetScrollInfo
ImageList_Replace
ord13
ImageList_Add
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_Duplicate
DrawStatusTextW
ImageList_GetBkColor
ImageList_LoadImageW
FlatSB_GetScrollPos
UninitializeFlatSB
ImageList_BeginDrag
ImageList_AddIcon
PropertySheetA
ImageList_GetIcon
CreateStatusWindowW
ImageList_SetOverlayImage

opengl32

glVertex3s
glNewList
glColor4uiv
glVertex3d
glColor3i
glPushMatrix
glCallList
glTexCoord2d
glRasterPos3fv
glScissor
glLogicOp
glEvalCoord1dv
wglShareLists
GlmfPlayGlsRecord
glColorMaterial
glTexCoord1f
glTexCoord1d
glTexCoord4iv
glTexCoord2f
glAlphaFunc
glLightiv
glColor4iv
glPixelMapusv

shell32

StrStrIA
StrChrIW

shlwapi

PathCommonPrefixA
SHRegQueryInfoUSKeyW
SHDeleteValueW
SHQueryInfoKeyA
StrToIntA
StrToIntExA
PathIsRootW
PathIsUNCServerW
PathIsUNCServerShareA
UrlUnescapeA
UrlEscapeA
SHQueryValueExA
SHRegGetUSValueA
PathGetDriveNumberA
HashData
SHRegSetUSValueW
SHRegWriteUSValueW
PathFindFileNameW
SHGetInverseCMAP
SHRegOpenUSKeyA
PathBuildRootA
PathMatchSpecA
PathStripToRootW
UrlCombineW
SHDeleteKeyW
ChrCmpIA
PathRenameExtensionW
SHRegCreateUSKeyA
StrIsIntlEqualA
SHRegQueryInfoUSKeyA
PathCompactPathW
PathIsUNCA
PathCombineW
UrlApplySchemeA
SHGetValueW
SHRegEnumUSKeyA
PathIsUNCServerShareW
SHRegDeleteEmptyUSKeyW
PathFindFileNameA
SHRegEnumUSValueA
SHQueryInfoKeyW
SHRegCloseUSKey
PathAppendA
PathMakePrettyW
PathFileExistsA
SHIsLowMemoryMachine
UrlCreateFromPathW
SHDeleteEmptyKeyW

version

GetFileVersionInfoW
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoSizeW
VerFindFileW
VerFindFileA
GetFileVersionInfoA
VerInstallFileW
VerQueryValueA
VerInstallFileA

winmm

WOW32DriverCallback
mciGetDeviceIDFromElementIDW
midiOutSetVolume
midiStreamProperty
mciGetCreatorTask
mmioFlush
joyGetDevCapsA
GetDriverModuleHandle
midiOutMessage
midiOutLongMsg
mxd32Message
mmTaskBlock
mciGetDeviceIDA
PlaySoundA
wod32Message
mod32Message
mixerGetLineInfoW
midiStreamOpen
waveOutRestart
OpenDriver
mciGetDriverData
mmioClose
sndPlaySoundW
DrvGetModuleHandle
midiInGetErrorTextA
waveInAddBuffer
mmioRenameA
mciGetDeviceIDFromElementIDA
waveInUnprepareHeader
midiInGetNumDevs
waveOutSetVolume
timeKillEvent
midiOutClose
NotifyCallbackData
mmioCreateChunk
midiInStart
mmioStringToFOURCCA
mid32Message
waveInClose
joySetThreshold
midiOutGetErrorTextW
midiInGetID
timeGetDevCaps
SendDriverMessage
mmioAdvance

winspool.drv

SetPrinterW
GetFormA
EnumPortsA
GetPrintProcessorDirectoryA
AddPortW
AddPrintProcessorW
GetJobA
DeletePrintProvidorW
DeletePrinter
EnumPortsW
GetPrinterDriverDirectoryW
ConvertAnsiDevModeToUnicodeDevmode

msvcrt

_rmdir
fseek
fsetpos
sprintf
_y1
feof
wcscpy
_heapadd
_wspawnle
ftell
fclose
gets
__p__dstbias
towlower
wcstol
__RTtypeid
fopen
_finite
_unlink
sqrt
difftime
ferror
_wmktemp
_copysign
fread
vfprintf
fprintf
_longjmpex
__fpecode
_beep
atof
strcpy
printf
_getmaxstdio
_wstrtime
__lc_codepage
__p__mbcasemap
localeconv
_mbsnextc
_mbsnbicmp
fputc
_heapset
_mbsncat
memset
__p__winmajor
fputs
strchr
fwprintf
fwrite

Exports

Exports

Acxpvrfh
Cijqm
Dsujrmoaxx
Fsvucw
Nphmtgd
Skogpc
Vqgcmfsqh
Vzowtztku
Wtiff
Xwkvtwuhjb

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d8ccebe37658fb2ee2c5242c4748d31b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

opengl32

shell32

shlwapi

version

winmm

winspool.drv

msvcrt

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 52KB - Virtual size: 51KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 52KB - Virtual size: 51KB

.reloc
Size: 8KB - Virtual size: 7KB