3def65e00c3450d56bb7bdc28e7fe4f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3def65e00c3450d56bb7bdc28e7fe4f6_JaffaCakes118
Size

249KB
MD5

3def65e00c3450d56bb7bdc28e7fe4f6
SHA1

9a3c33c93d0cd1c504f8ce0c016d50780f01aaf8
SHA256

809cc7f2c6e2dd5ca034ab91bb2da68355437f18ee8ce370305d5d4ac1a13424
SHA512

32a3d8a1d2c151f4d0be7764d25d99a9697867815019744439171ea270040831b26783c342848c8873c238d5f0184b21f18c46ac51908dffbb36641beb2bb77e
SSDEEP

6144:84t2gHNZUaPiQrDQ7r3Upk+Mo68p/ehiK2LNAt6Np/z:84ggtSaVDQ3UW+E8ZeAfAtkt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3def65e00c3450d56bb7bdc28e7fe4f6_JaffaCakes118

Files

3def65e00c3450d56bb7bdc28e7fe4f6_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

13d65c973946fce4d0962eaadf38ba2b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

netman.pdb

Imports

advapi32

RegCreateKeyExW
DuplicateTokenEx
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
RegNotifyChangeKeyValue
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegEnumValueW
UnlockServiceDatabase
LockServiceDatabase
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegDeleteValueW
OpenThreadToken
RegEnumKeyExW
AdjustTokenPrivileges
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
GetTokenInformation
OpenProcessToken

iphlpapi

GetAdaptersInfo

kernel32

GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
FormatMessageW
LockResource
VerifyVersionInfoW
lstrcmpW
InterlockedExchange
Sleep
UnregisterWaitEx
RegisterWaitForSingleObject
DuplicateHandle
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
QueueUserWorkItem
GetOverlappedResult
CreateThread
LocalFree
ResetEvent
GetPrivateProfileStringW
GetPrivateProfileSectionW
SetLastError
DeviceIoControl
LocalAlloc
WriteFile
GetStdHandle
GetSystemDefaultLCID
GetCurrentProcessId
GetTickCount
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
lstrlenW
lstrcpyW
GetLastError
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetCurrentThreadId
CloseHandle
GetCurrentProcess
WaitForSingleObject
HeapDestroy
lstrcatW
GetModuleFileNameW
lstrcpynW
GetCurrentThread
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CreateFileW
CreateEventW
OpenEventW
SetEvent
GetProcAddress
LoadLibraryW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter

mprapi

MprAdminServerConnect
MprAdminConnectionGetInfo
MprAdminPortEnum
MprAdminBufferFree
MprAdminServerDisconnect

msvcrt

_snwprintf
wcsncmp
_wtoi
qsort
_except_handler3
strncpy
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_CxxThrowException
_wsplitpath
mbstowcs
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
??0exception@@QAE@ABQBD@Z
_snprintf
?what@exception@@UBEPBDXZ
wcscmp
wcscat
_wcsnicmp
memmove
wcsstr
wcschr
wcstoul
_wcsicmp
wcsncpy
__CxxFrameHandler
_purecall
wcsrchr
wcscpy
wcslen
_vsnprintf

netapi32

NetApiBufferFree
NetGetJoinInformation

netshell

HrIsIpStateCheckingEnabled
HrGetExtendedStatusFromNCS

ntdll

RtlDeregisterWait
RtlInitUnicodeString
NtClose
RtlOpenCurrentUser
VerSetConditionMask
RtlRegisterWait
RtlDeregisterWaitEx
RtlGetNtProductType
RtlNtStatusToDosError
NtOpenFile

ole32

CoImpersonateClient
CoRevertToSelf
CLSIDFromString
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
IIDFromString
StringFromGUID2

oleaut32

SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen
VarI4FromStr
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayDestroy
SysStringByteLen
VariantInit

rasapi32

RasDeleteEntryW
RasSetAutodialAddressW
DwCloneEntry
RasRenameEntryW
RasEnumConnectionsW
RasHangUpW
RasGetConnectStatusW
DwEnumEntryDetails
RasValidateEntryNameW

rtutils

TracePrintfA
TraceVprintfExA
TraceRegisterExA

secur32

GetUserNameExW

shell32

SHGetFolderPathW

user32

ExitWindowsEx
LoadImageW
DestroyIcon
RegisterDeviceNotificationW
UnregisterDeviceNotification
wsprintfW
LoadStringW
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
CharNextW
MessageBoxW

wininet

InternetCrackUrlW

ws2_32

freeaddrinfo
WSAStartup
WSANSPIoctl
WSACleanup
WSALookupServiceEnd
WSALookupServiceNextW
getnameinfo
socket
WSAEventSelect
WSAIoctl
WSAEnumNetworkEvents
closesocket
inet_addr
WSALookupServiceBeginW
WSAGetLastError
getaddrinfo

wzcsapi

GetModeForAdapter

wzcsvc

WZCQueryGUIDNCSState
WZCTrayIconReady

Exports

Exports

DllRegisterServer
DllUnregisterServer
GetClientAdvises
HrGetPnpDeviceStatus
HrLanConnectionNameFromGuidOrPath
HrPnpInstanceIdFromGuid
HrQueryLanMediaState
HrRasConnectionNameFromGuid
NetManDiagFromCommandArgs
ProcessQueue
RasEventNotify
ServiceMain

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13d65c973946fce4d0962eaadf38ba2b

Headers

File Characteristics

PDB Paths

Imports

advapi32

iphlpapi

kernel32

mprapi

msvcrt

netapi32

netshell

ntdll

ole32

oleaut32

rasapi32

rtutils

secur32

shell32

user32

wininet

ws2_32

wzcsapi

wzcsvc

Exports

Exports

Sections

.text Size: 169KB - Virtual size: 169KB

.data Size: 58KB - Virtual size: 57KB

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 169KB - Virtual size: 169KB

.data
Size: 58KB - Virtual size: 57KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 9KB - Virtual size: 8KB