3a8098aa13c94e795fdb372554bb97c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3a8098aa13c94e795fdb372554bb97c7_JaffaCakes118
Size

88KB
MD5

3a8098aa13c94e795fdb372554bb97c7
SHA1

cd6857d7b17f06c2bf59fef9b14e874b8e4ee16d
SHA256

b2cb3f358092f8de15180862818e8cfafe1e9b49e13cd7c0a42c60307e71e623
SHA512

c500ef8243763707c02b9e17d390ea8ee95af121604889bd8008f673e4eaf25bf12ac9e603d33b7d4d8a2f2ec5a004d032d257e0b4202a8991e411c91243e0a0
SSDEEP

1536:/JHIMYk3zb1qcEg6Pk0u3GjBVfJiQiFZCJrjuw006a0SMR48lj:/JHf9FqcgP/u21NJiQiFw9Kw006GQ48J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a8098aa13c94e795fdb372554bb97c7_JaffaCakes118

Files

3a8098aa13c94e795fdb372554bb97c7_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

2abde1a6f563728713e90f0f9db6056f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
MoveFileExA
DebugBreak
GetFileSize
HeapAlloc
HeapReAlloc
HeapFree
DisableThreadLibraryCalls
GetSystemInfo
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
lstrlenW
GetModuleHandleA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
FlushInstructionCache
Sleep
_lcreat
RemoveDirectoryA
FindNextFileA
DeleteFileA
InterlockedExchange
GetExitCodeProcess
GetTickCount
WideCharToMultiByte
SetFilePointer
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
CreateDirectoryA
GetLocalTime
WriteFile
GetEnvironmentVariableA
_lwrite
_lclose
LocalFree
WaitForSingleObject
GetProcAddress
SetEndOfFile
GetSystemDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
LoadLibraryA
FreeLibrary
MultiByteToWideChar
GetShortPathNameA
FindFirstFileA
FindClose
CopyFileA
CreateSemaphoreA
GetLastError
lstrcmpA
GetWindowsDirectoryA
lstrcatA
CreateProcessA
CloseHandle
GetModuleFileNameA
lstrlenA
LocalAlloc
lstrcpyA
GetCurrentProcess
lstrcmpiA
GetCurrentThread
_lread
GetVersionExA
_lopen
GetCurrentProcessId
_llseek
CompareFileTime
HeapDestroy
GetCurrentThreadId

user32

WaitMessage
MsgWaitForMultipleObjects
SendMessageA
BeginPaint
EndPaint
DispatchMessageA
GetDC
ReleaseDC
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UpdateWindow
TranslateMessage
IsChild
DestroyWindow
GetClassInfoExA
LoadCursorA
RegisterClassExA
CharNextA
GetWindowLongA
SetWindowLongA
UnionRect
PtInRect
GetKeyState
DefWindowProcA
MessageBoxA
wsprintfA
PeekMessageA
SetTimer
ShowWindow
RegisterClassA
ValidateRect
PostQuitMessage
KillTimer
IsWindow
GetFocus
CallWindowProcA
CreateWindowExA
GetClientRect

gdi32

SetTextAlign
SetViewportOrgEx
SetWindowOrgEx
DeleteDC
SaveDC
LPtoDP
SetMapMode
CreateDCA
GetDeviceCaps
Rectangle
CreateRectRgnIndirect
RestoreDC
TextOutA

advapi32

SetSecurityDescriptorDacl
RegCloseKey
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
FreeSid
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
ImpersonateSelf
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA

ole32

OleSaveToStream
WriteClassStm
OleLoadFromStream
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr
RegisterTypeLi
LoadTypeLi
SysAllocStringLen
SysAllocString
SysStringLen
VariantChangeType
SysFreeString
VariantClear
SysStringByteLen
LoadRegTypeLi
SysAllocStringByteLen

ws2_32

WSCUnInstallNameSpace
WSCInstallNameSpace
WSACleanup
WSAGetLastError
WSAStartup
WSASetLastError
WSALookupServiceBeginW
WSALookupServiceNextW
WSALookupServiceEnd
closesocket
htons
WSASocketA
ntohs
WSAIoctl
WSCDeinstallProvider
WSCEnumProtocols
WSCInstallProvider
WSCGetProviderPath

wininet

InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NSPStartup
NewDotNetInstall
NewDotNetStartup
NewDotNetUninstall
WSPStartup
_Java_TLDApplet_getVersion@8
_Java_TLDApplet_install__Ljava_lang_String_2@12
_Java_TLDInstall_install@8

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2abde1a6f563728713e90f0f9db6056f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

wininet

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 8KB

.shared Size: 4KB - Virtual size: 8B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 8KB

.shared
Size: 4KB - Virtual size: 8B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 3KB