3a7c7cb3845d3cce301610b2af417983_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3a7c7cb3845d3cce301610b2af417983_JaffaCakes118
Size

79KB
MD5

3a7c7cb3845d3cce301610b2af417983
SHA1

fe5a81a5bc9fbb48eec53446702e92d74f6081c4
SHA256

3c09326dceec536f0ef8ecb4a428acbef91026f716b2ff0a4115529a9a0e57f7
SHA512

66ddfdea8f1cb77dbf049d55155b7f6b908ae0ce113a168a89644a4cd27e656df0847bd8f6cc785a0e57c46e47e70ea3ec5a767f4459a5f73c28015633a71226
SSDEEP

1536:h6fTLCTVZsCM3DWritJrR/R+UodwoXJmpyWCIMZ3OxboYD29m6T7buzMt:IaAn7tn5F6wKmpyW/MF+jDM9T7C8

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/data/6to4svc.dll
unpack001/data/aaaamon.dll
unpack001/data/adptif.dll

Files

3a7c7cb3845d3cce301610b2af417983_JaffaCakes118
.rar
data/6to4svc.dll
.dll windows:5 windows x86 arch:x86

ceee11e482f10fe076bdb03226c7103e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

6to4svc.pdb

Imports

msvcrt

swprintf
malloc
memcpy
wcslen
strlen
_adjust_fdiv
memcmp
memset
wcscpy
_wcsicmp
wcscmp
wcsncpy
_initterm
free
memmove
wcschr
_except_handler3
wcscat

ntdll

RtlInitUnicodeString
RtlGUIDFromString
RtlStringFromGUID

kernel32

FreeLibrary
QueryPerformanceCounter
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
HeapAlloc
HeapFree
CreateTimerQueue
InterlockedIncrement
InterlockedDecrement
RegisterWaitForSingleObject
CreateEventW
CloseHandle
UnregisterWait
DeleteTimerQueueTimer
DeleteTimerQueue
CreateTimerQueueTimer
ChangeTimerQueueTimer
ReleaseMutex
WaitForSingleObject
UnregisterWaitEx
Sleep
GetComputerNameExW
HeapReAlloc
CreateFileW
DeviceIoControl
GetTickCount
HeapDestroy
CreateMutexW
HeapCreate
DisableThreadLibraryCalls
BindIoCompletionCallback
ReadFile
WriteFile
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
DeleteCriticalSection
QueueUserWorkItem
SetEvent
SetLastError
GetProcAddress

wmi

WmiNotificationRegistrationW

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo
NotifyAddrChange
NotifyRouteChange

ws2_32

WSALookupServiceEnd
ntohl
WSALookupServiceBeginW
WSAEventSelect
WSASendTo
htonl
htons
WSALookupServiceNextW
WSARecvFrom
shutdown
setsockopt
listen
WSAAddressToStringA
bind
WSAGetLastError
WSAAddressToStringW
getaddrinfo
socket
closesocket
WSAStringToAddressA
freeaddrinfo
WSAStartup
WSASocketW
WSAIoctl
inet_ntoa
ntohs
getsockname
getnameinfo

rtutils

TracePrintfExW
TraceDeregisterW
RouterLogRegisterW
TraceRegisterExW
RouterLogDeregisterW

advapi32

CryptAcquireContextW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegQueryValueExW
CryptReleaseContext
CryptGenRandom

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree

dnsapi

DnsReplaceRecordSetW

mswsock

GetAcceptExSockaddrs
AcceptEx

Exports

Exports

ServiceMain

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/aaaamon.dll
.dll windows:5 windows x86 arch:x86

7ddbb81db3870b95876c4f80e1a97338

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

free
wcscat
wcsncpy
calloc
wcscpy
__CxxFrameHandler
wcsstr
wcstok
_snwprintf
wcslen
_itow
wcsncat

msvcp60

?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z

ntdll

RtlCompressBuffer
RtlAllocateHeap
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlFreeHeap

advapi32

RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ControlService

kernel32

InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentProcess
DeleteFileW
UnmapViewOfFile
HeapFree
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
WriteFile
VirtualFree
DisableThreadLibraryCalls
VirtualAlloc
ReadFile
HeapAlloc
GetProcessHeap

netsh.exe

PrintMessageFromModule
RegisterHelper
PrintMessage
PrintError
MatchToken
MatchEnumTag
RegisterContext

ole32

CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringLen

shlwapi

SHGetValueW

userenv

ExpandEnvironmentStringsForUserW

Exports

Exports

InitHelperDll

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/adptif.dll
.dll windows:5 windows x86 arch:x86

dcd0c28d06d1202e91286d07d29caebe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind
NtCreateFile
RtlInitUnicodeString
NtClose
NtDeviceIoControlFile
RtlFreeHeap
wcsncpy
wcsstr
NtWaitForSingleObject
RtlAllocateHeap
NtOpenFile
RtlQueueWorkItem
RtlNtStatusToDosError

advapi32

SetServiceStatus
QueryServiceStatus
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
RegisterServiceCtrlHandlerA

kernel32

InterlockedIncrement
Sleep
DeleteCriticalSection
CreateEventA
InitializeCriticalSection
GetLastError
DeviceIoControl
BindIoCompletionCallback
GlobalFree
GlobalAlloc
SleepEx
lstrlenW
InterlockedDecrement
SetLastError
GetOverlappedResult
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResetEvent
LeaveCriticalSection
EnterCriticalSection
SetEvent
lstrcpyW
WaitForSingleObject

rtutils

SetIoCompletionProc
TraceDeregisterA
TracePutsExA
TracePrintfExA
TraceDumpExA
TraceRegisterExA
TraceDeregisterExA
TracePrintfA

ws2_32

WSARecvFrom
sendto
WSACleanup
closesocket
getsockopt
bind
htons
setsockopt
socket
WSAStartup
WSAGetLastError

Exports

Exports

CreateSocketPort
DeleteSocketPort
FwBindFwInterfaceToAdapter
FwConnectionRequestFailed
FwCreateInterface
FwDeleteInterface
FwDisableFwInterface
FwEnableFwInterface
FwGetInterface
FwGetNotificationResult
FwGetStaticNetbiosNames
FwIsStarted
FwNotifyConnectionRequest
FwSetInterface
FwSetStaticNetbiosNames
FwStart
FwStop
FwUnbindFwInterfaceFromAdapter
FwUpdateConfig
FwUpdateRouteTable
GetAdapterNameFromMacAddrW
GetAdapterNameW
GetFilters
IpxAdjustIoCompletionParams
IpxCreateAdapterConfigurationPort
IpxDeleteAdapterConfigurationPort
IpxDoesRouteExist
IpxGetAdapterConfig
IpxGetAdapterList
IpxGetOverlappedResult
IpxGetQueuedAdapterConfigurationStatus
IpxGetQueuedCompletionStatus
IpxPostQueuedCompletionStatus
IpxRecvPacket
IpxSendPacket
IpxWanCreateAdapterConfigurationPort
IpxWanQueryInactivityTimer
IpxWanSetAdapterConfiguration
ServiceMain
SetFilters

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/log.imf
data/ocxmanaghr.dll
data/stikls.dll
data/stikls1.dll

Sharing

General

Malware Config

Signatures

Files

ceee11e482f10fe076bdb03226c7103e

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

wmi

iphlpapi

ws2_32

rtutils

advapi32

ole32

dnsapi

mswsock

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 2KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

7ddbb81db3870b95876c4f80e1a97338

Headers

File Characteristics

Imports

msvcrt

msvcp60

ntdll

advapi32

kernel32

netsh.exe

ole32

oleaut32

shlwapi

userenv

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 292B

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 1024B - Virtual size: 934B

dcd0c28d06d1202e91286d07d29caebe

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

rtutils

ws2_32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 32KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 2KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 292B

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 1024B - Virtual size: 934B

.text
Size: 21KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 32KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 2KB - Virtual size: 1KB