4407fad5e3c5428b187640f90e7c282d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4407fad5e3c5428b187640f90e7c282d_JaffaCakes118
Size

848KB
MD5

4407fad5e3c5428b187640f90e7c282d
SHA1

e8cad4b38b17c3cc815cfa4187b191a3bcec055c
SHA256

e22cca42b5721601c61327b7e6e2a4dbe59184cf3934efe57fb206b00efeb0bb
SHA512

f1e23933ce5f6b9f5f3193d5d78b8003400622757081aff4b44e8d7c3fa6dc67b2eaf43c092e2fd814dafa986945e31f19f6a1e58fe9c079f04a29147fead9a2
SSDEEP

24576:lOT2+d28/zVObhlrDcHFwMiDrGrnd1Nt0Po1jTojcKh:e2GObDrDclwMPzd1NuPo1jTojcKh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4407fad5e3c5428b187640f90e7c282d_JaffaCakes118

Files

4407fad5e3c5428b187640f90e7c282d_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

7c0945c7f44d4a7fbf048e7c9916d63d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

comctl32

ord17

wsock32

WSACancelAsyncRequest
WSAStartup
WSACleanup
WSAAsyncGetHostByName

msimg32

GradientFill

kernel32

GetTickCount
SetEvent
CloseHandle
CreateEventA
CreateFileA
ResetEvent
lstrcmpA
DeleteFileA
WaitForSingleObject
SetLastError
GetLocalTime
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetCurrentProcessId
CreateSemaphoreA
WaitForMultipleObjects
ReleaseSemaphore
GetProcAddress
LoadLibraryA
Sleep
GlobalUnlock
GlobalLock
GlobalAlloc
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
ResumeThread
SetThreadPriority
TerminateThread
CreateThread
MoveFileA
GetSystemTime
TlsSetValue
TlsGetValue
GetProcessHeap
OutputDebugStringA
FindClose
FindNextFileA
FindFirstFileA
SetFileTime
FileTimeToSystemTime
GetFileTime
TlsAlloc
SetUnhandledExceptionFilter
VirtualQuery
IsBadWritePtr
GetCurrentThread
CreateProcessA
CreateDirectoryA
ReleaseMutex
CreateMutexA
VirtualProtect
IsBadReadPtr
GetUserDefaultLangID
HeapFree
IsBadCodePtr
QueryPerformanceCounter
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
HeapSize
TlsFree
TerminateProcess
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
GetSystemInfo
VirtualAlloc
LocalFree
HeapAlloc
FormatMessageA
LocalAlloc
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
IsDBCSLeadByte
lstrcatA
GetModuleFileNameA
lstrcpyA
lstrcpynA
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
MulDiv
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
SetStdHandle
FlushFileBuffers
SetEndOfFile

user32

LoadImageA
LoadStringA
SetPropA
MsgWaitForMultipleObjects
PostThreadMessageA
PeekMessageA
CharLowerBuffA
GetCursorPos
SetForegroundWindow
EnumChildWindows
LoadBitmapA
CreateAcceleratorTableA
RemovePropA
GetClassNameA
DestroyAcceleratorTable
InvalidateRgn
RegisterWindowMessageA
GetWindowTextLengthA
SetWindowTextA
GetLastActivePopup
DrawTextA
SetParent
CharNextA
PtInRect
UnionRect
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
UnregisterClassA
ReleaseDC
GetDC
SetWindowLongA
DefWindowProcA
GetWindowLongA
CallWindowProcA
GetKeyState
DestroyWindow
IsWindow
InvalidateRect
ShowWindow
SetFocus
IsChild
GetFocus
GetParent
wsprintfA
ShowWindowAsync
PostQuitMessage
SetCursor
GetSystemMetrics
GetWindowRgn
ReleaseCapture
GetDesktopWindow
GetSysColorBrush
GetPropA
GetDlgItem
GetTopWindow
RedrawWindow
GetWindowThreadProcessId
ReplyMessage
SendMessageTimeoutA
GetForegroundWindow
IsWindowVisible
MessageBoxA
GetWindowRect
SetWindowsHookExA
CallNextHookEx
GetWindowTextA
GetMessageA
UnhookWindowsHookEx
GetWindow
ClientToScreen
KillTimer
SetTimer
SendMessageA
PostMessageA
LoadAcceleratorsA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetSysColor
FillRect
MoveWindow
RegisterClassExA
GetClassInfoExA
LoadCursorA
CreateWindowExA
BeginPaint
GetClientRect
EndPaint
SetCapture

gdi32

CreateSolidBrush
GetTextExtentPoint32A
CreateFontIndirectA
SetBkMode
TextOutA
SelectPalette
RealizePalette
CreatePen
CombineRgn
StretchBlt
CreatePatternBrush
GetStockObject
GetObjectA
MoveToEx
LineTo
FillRgn
FrameRgn
CreateRectRgn
PtInRegion
CreatePolygonRgn
CreateRoundRectRgn
CreateRectRgnIndirect
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SetTextColor
SetBkColor
CreateBitmap
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
Polyline
SetStretchBltMode

advapi32

RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegOpenKeyExA

ole32

CoUninitialize
OleSaveToStream
WriteClassStm
OleLoadFromStream
StringFromGUID2
CoCreateInstance
CoInitialize
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
OleRun
CreateStreamOnHGlobal
OleInitialize
OleLockRunning
OleUninitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
CoCreateGuid
CreateOleAdviseHolder

oleaut32

LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantInit
VariantClear
SysStringByteLen
VariantChangeType
VarUI4FromStr
SysAllocStringByteLen
LoadRegTypeLi
SysStringLen
OleCreatePropertyFrame
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantCopy
DispCallFunc
SysAllocStringLen
SafeArrayGetLBound
OleCreateFontIndirect
VarBstrCat
SafeArrayCopy
SafeArrayDestroy
SafeArrayPutElement
GetErrorInfo
SafeArrayGetUBound
SysFreeString

shlwapi

StrRChrA
StrToIntA
PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 572KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c0945c7f44d4a7fbf048e7c9916d63d

Headers

File Characteristics

Imports

version

comctl32

wsock32

msimg32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 572KB - Virtual size: 568KB

.rdata Size: 160KB - Virtual size: 158KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 60KB - Virtual size: 59KB

.text
Size: 572KB - Virtual size: 568KB

.rdata
Size: 160KB - Virtual size: 158KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 60KB - Virtual size: 59KB