3f975b2938f3b916d4d489063aefc127_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3f975b2938f3b916d4d489063aefc127_JaffaCakes118
Size

437KB
MD5

3f975b2938f3b916d4d489063aefc127
SHA1

18acc5aecfeb0bdea158e8c462f3f08470203990
SHA256

9583a9cfb616b972a2ad2f3443230b3726dd0f62bf4d19f6df471b0fca144324
SHA512

25d9fbf2d88eefdbf5643cbd2e5cc4ea680b51f4b368eede46b08ddee8695ee993c996423838fbe022dbefca8880edfc97ca01e2cd84f63cd7991571a7ae1337
SSDEEP

6144:HIJzf9v4HZgLqTMgwmSE4UmYbSBYm3Ew2v17QskFUGYMMWN3sAdqBqUQlRXvFj0w:HIvAhgmAUm+SBtUw2vZ/4VYMhMg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f975b2938f3b916d4d489063aefc127_JaffaCakes118

Files

3f975b2938f3b916d4d489063aefc127_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ab448c9747b7583db97a7cbb9fec02d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

wcstoul
wcsstr
wcsrchr
towupper
qsort
memset
memmove
memcpy
iswspace
ceil
bsearch
_wcsicmp
_vsnwprintf
_vsnprintf
RtlUnwind
_CIlog

winmm

PlaySoundW

gdi32

SelectObject
RestoreDC
Rectangle
RealizePalette
GetStockObject
GetObjectW
DeleteObject
DeleteDC
CreateSolidBrush
CreatePen
CreateHalftonePalette
CreateDIBSection
CreateCompatibleDC
BitBlt
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetStretchBltMode
SetTextColor
StretchBlt
SaveDC

kernel32

RemoveDirectoryW
ReleaseMutex
ReadFile
RaiseException
QueryPerformanceCounter
OutputDebugStringA
OpenFileMappingW
MultiByteToWideChar
MulDiv
MoveFileW
MoveFileExW
MapViewOfFile
LockResource
LocalFree
LocalAlloc
LoadResource
LoadLibraryW
LoadLibraryExW
LoadLibraryA
LeaveCriticalSection
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSection
HeapFree
HeapAlloc
GetVolumeInformationW
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetTempPathW
ResetEvent
GetSystemTimeAsFileTime
GetSystemTime
GetProcessPriorityBoost
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetLongPathNameW
GetLogicalDriveStringsW
GetLocalTime
GetLastError
GetFileSize
GetFileAttributesW
GetEnvironmentVariableW
GetDriveTypeW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCommandLineA
FreeLibraryAndExitThread
FreeLibrary
FormatMessageW
FlushInstructionCache
FindResourceW
FindResourceExW
FindNextFileW
FindClose
FileTimeToSystemTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DisableThreadLibraryCalls
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileMappingW
CreateEventW
CreateDirectoryW
CopyFileExW
CompareStringW
CompareFileTime
CloseHandle
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFileTime
SetLastError
SetThreadLocale
SetUnhandledExceptionFilter
SizeofResource
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WaitForMultipleObjects
WriteFile
lstrcmpiW
lstrlenW
GetTempFileNameW
SetFilePointer

shlwapi

StrRetToBufW
StrCmpW
StrCmpNIW
StrCSpnW
SHStrDupW
PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW
PathParseIconLocationW
PathMatchSpecW
PathIsDirectoryW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathAppendW
PathAddBackslashW
StrStrW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceW
SetupDiOpenDevRegKey
SetupDiCreateDeviceInfoList

rpcrt4

CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleAllocate
NdrOleFree
CStdStubBuffer_AddRef

advapi32

RegOpenKeyExW
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
GetTraceEnableFlags
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
InitializeAcl
GetTraceLoggerHandle
GetTraceEnableLevel

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
MoveWindow
UnhookWinEvent
UnregisterClassA
UnregisterDeviceNotification
MonitorFromRect
MessageBoxW
MessageBeep
MapWindowPoints
MapDialogRect
AllowSetForegroundWindow
LoadImageW
LoadCursorW
IsWindowVisible
IsWindowEnabled
SetWindowLongW
IsDlgButtonChecked
InvalidateRect
IntersectRect
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
GetWindowLongW
GetWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetPropW
GetParent
GetMonitorInfoW
GetMessageW
GetLastActivePopup
GetDlgItem
GetDesktopWindow
SetWinEventHook
SetPropW
SetForegroundWindow
SetFocus
SetDlgItemTextW
SetCursor
SendMessageW
SendDlgItemMessageW
RemovePropW
ReleaseDC
RegisterWindowMessageW
RegisterDeviceNotificationW
PostThreadMessageW
PostMessageW
PeekMessageW
OffsetRect
IsWindow
MsgWaitForMultipleObjects
GetDC
GetCursor
GetClientRect
GetClassNameW
FillRect
EnumWindows
EndDialog
EndDeferWindowPos
EnableWindow
EnableMenuItem
DrawTextW
DispatchMessageW
DialogBoxParamW
DestroyWindow
DestroyMenu
DestroyIcon
DeferWindowPos
CreateWindowExW
CreatePopupMenu
CreateDialogParamW
CopyImage
CharUpperW
CharUpperBuffW
CharNextW
BeginDeferWindowPos
TranslateMessage

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFileInfoW
SHChangeNotify
SHBrowseForFolderW
SHBindToParent
DragQueryFileW
CommandLineToArgvW
SHGetDesktopFolder

oleaut32

BSTR_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserUnmarshal
LoadTypeLi
RegisterTypeLi
SysAllocString
SysFreeString
SysStringLen
UnRegisterTypeLi
VarBstrCmp
VarUI4FromStr
VariantClear
VariantInit
LPSAFEARRAY_UserFree
BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserMarshal
VariantTimeToSystemTime
LPSAFEARRAY_UserMarshal

ole32

HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
PropVariantClear
PropVariantCopy
ReleaseStgMedium
StringFromGUID2
CreateBindCtx
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoAllowSetForegroundWindow
CLSIDFromString
HBITMAP_UserFree

msvcrt

_amsg_exit
_errno
_initterm
_lock
__dllonexit
_unlock
calloc
free
malloc
realloc
_XcptFilter
_CxxThrowException
_CIexp
_onexit

Exports

Exports

IncrementalDecoder
Number_Power
ReadLastObjectFromFile
SoftSpace
ValueError
get_interlace_type
set_flush
set_sig_bytes

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab448c9747b7583db97a7cbb9fec02d3

Headers

File Characteristics

Imports

ntdll

winmm

gdi32

kernel32

shlwapi

setupapi

rpcrt4

advapi32

version

user32

shell32

oleaut32

ole32

msvcrt

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 258KB - Virtual size: 258KB

.data Size: 70KB - Virtual size: 71KB

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 258KB - Virtual size: 258KB

.data
Size: 70KB - Virtual size: 71KB

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 3KB - Virtual size: 3KB