29e543e19db8c69655bb8c538023378d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29e543e19db8c69655bb8c538023378d_JaffaCakes118
Size

407KB
MD5

29e543e19db8c69655bb8c538023378d
SHA1

19019ecef4d304ca5649bbc8012d298cb0a59105
SHA256

39d4dcd1bcec2a7cbc69b5411bd49a597351aac0cd9ede24be8da77f16595b5a
SHA512

67b00fae5eca6d6cdefbd9b2ccca2d8f373b7516e5cd690f49968609c1e2e547583d6bcf3f8c176244a87c0dd70c03d263c76343455dc6ca49d95fc6a4f84d07
SSDEEP

6144:nRMywiuSGDl5mKlouSo+tpVmyADMaozxOKWg8a4oUpxiNpKblqjo8o563V1IzCSY:RMywiGDeKsY9QPF0ghHpclP8o56FDH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29e543e19db8c69655bb8c538023378d_JaffaCakes118

Files

29e543e19db8c69655bb8c538023378d_JaffaCakes118
.dll windows:5 windows x86 arch:x86

12aed0f305aa4c0a105e345bdbd481b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind

user32

GetForegroundWindow
GetDC
EqualRect
IntersectRect
ChangeDisplaySettingsA
RedrawWindow
UnionRect
GetClassInfoA
wsprintfA
GetDCEx
GetClientRect
ClientToScreen
GetWindowThreadProcessId
SetCursor
KillTimer
SetWindowLongA
SendMessageA
IsIconic
PostMessageA
CallWindowProcA
GetKeyState
SetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetLastActivePopup
GetAsyncKeyState
keybd_event
SystemParametersInfoA
SetForegroundWindow
SetWindowPos
OffsetRect
ShowWindow
IsZoomed
SetTimer
ClipCursor
GetDesktopWindow
GetWindow
GetWindowLongA
IsWindowVisible
IsWindowEnabled
GetParent
DefWindowProcA
RegisterClassA
CreateWindowExA
DestroyWindow
UnregisterClassA
GetKeyboardType
MessageBoxIndirectA
LoadStringA
GetSystemMetrics
EnumDisplaySettingsA
IsRectEmpty
CopyRect
SetRect
mouse_event
IsWindow
ReleaseDC

advapi32

RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

GetStdHandle
WriteFile
GetCPInfo
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
RaiseException
ExitProcess
LCMapStringW
LCMapStringA
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
GetModuleFileNameA
SetFilePointer
GetACP
GetOEMCP
lstrcmpiA
GetPriorityClass
SetPriorityClass
lstrlenA
LocalAlloc
LocalFree
GetCurrentProcessId
GetLastError
GetSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
MakeCriticalSectionGlobal
ReinitializeCriticalSection
InterlockedExchange
ord93
DisableThreadLibraryCalls
ord98
ord97
GetModuleHandleA
lstrcpyA
IsBadCodePtr
GlobalMemoryStatus
SetErrorMode
lstrcpynA
CloseHandle
GetExitCodeThread
WaitForSingleObject
CreateThread
IsBadWritePtr
GetSystemDefaultLCID
MapSLFix
OpenVxDHandle
UnMapLS
MapLS
IsBadReadPtr
GetProfileIntA
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentThreadId
GetPrivateProfileIntA
DeviceIoControl
OutputDebugStringA
ThunkConnect32
FT_Thunk
FT_Exit4
FT_Exit20
SMapLS
SUnMapLS
SMapLS_IP_EBP_8
SUnMapLS_IP_EBP_8
SMapLS_IP_EBP_12
SUnMapLS_IP_EBP_12
SMapLS_IP_EBP_16
SUnMapLS_IP_EBP_16
SMapLS_IP_EBP_20
SUnMapLS_IP_EBP_20
MapSL
HeapAlloc
HeapFree
HeapReAlloc
HeapCreate
GetVersionExA
CreateFileA
ReleaseMutex
SetEvent
UnmapViewOfFile
OpenMutexA
MapViewOfFile
CreateFileMappingA
CreateEventA
CreateProcessA
OpenEventA
GetCurrentProcess
lstrcatA
_lclose
ReadFile
OpenFile
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA

gdi32

StretchBlt
SetBkColor
ExtTextOutA
PatBlt
StretchDIBits
SetObjectOwner
GetObjectType
SaveDC
SetPaletteEntries
SelectPalette
RealizePalette
SetSystemPaletteUse
DeleteDC
SetStretchBltMode
GetDIBits
CreateDIBSection
CreateCompatibleDC
SelectObject
GetSystemPaletteEntries
SetDIBColorTable
BitBlt
RestoreDC
GetDeviceCaps
CreatePalette
ResizePalette
DeleteObject
CreateDCA
GetNearestColor
ExtEscape
GetStockObject
GetRegionData
GetDeviceGammaRamp
SetDeviceGammaRamp
CreateCompatibleBitmap

Exports

Exports

AcquireDDThreadLock
D3DParseUnknownCommand
DDGetAttachedSurfaceLcl
DDHAL32_VidMemAlloc
DDHAL32_VidMemFree
DDInternalLock
DDInternalUnlock
DSoundHelp
DdEntry1
DdEntry10
DdEntry11
DdEntry12
DdEntry13
DdEntry16
DdEntry17
DdEntry18
DdEntry19
DdEntry2
DdEntry20
DdEntry3
DdEntry4
DdEntry5
DdEntry6
DdEntry7
DdEntry8
DdEntry9
DirectDrawCreate
DirectDrawCreateClipper
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DllCanUnloadNow
DllGetClassObject
GetAliasedVidMem
GetDDSurfaceLocal
GetNextMipMap
GetOLEThunkData
GetSurfaceFromDC
HeapVidMemAllocAligned
InternalLock
InternalUnlock
LateAllocateSurfaceMem
RegisterSpecialCase
ReleaseDDThreadLock
VidMemAlloc
VidMemAmountFree
VidMemFini
VidMemFree
VidMemInit
VidMemLargestFree
thk1632_ThunkData32
thk3216_ThunkData32

Sections

.text
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12aed0f305aa4c0a105e345bdbd481b3

Headers

File Characteristics

Imports

ntdll

user32

advapi32

version

kernel32

gdi32

Exports

Exports

Sections

.text Size: 300KB - Virtual size: 300KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 83KB - Virtual size: 84KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 300KB - Virtual size: 300KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 83KB - Virtual size: 84KB

.reloc
Size: 14KB - Virtual size: 14KB