45b5d10a4d42755fce997e7bf65272ae_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

45b5d10a4d42755fce997e7bf65272ae_JaffaCakes118
Size

288KB
MD5

45b5d10a4d42755fce997e7bf65272ae
SHA1

9e52cec62b30fa9b105446e0e3ae16c5e669d7dd
SHA256

7680989c3867feb533cb6b69cf501e0a79a886c943c1e6c0430f0cecbef2253d
SHA512

55cba98509cd35d29f1353b20cf0759e84850d97aacf8947d50db39b468c784245dcf84a6935f6b0e4d30819990bb5085d98a12c799bd6df47b37280786f1724
SSDEEP

3072:0VYLx1J6tf/sPnP5B26gsHDWClpP5B/zdKskftQWw2U1nPi8meeON/xAc5A8J3mt:0QxKZ/qPgOriskVTwGtON/KJoI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45b5d10a4d42755fce997e7bf65272ae_JaffaCakes118

Files

45b5d10a4d42755fce997e7bf65272ae_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

87dad2acbf7ffb1c937d50e8c97c0758

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
CopyFileA
VirtualQuery
GetVersionExA
GlobalFree
DeviceIoControl
GlobalAlloc
CreateDirectoryA
lstrcatA
lstrcpyA
GetTickCount
WaitForSingleObject
ExitProcess
SetLastError
GetLongPathNameA
OpenProcess
CreateMutexA
GetShortPathNameA
GetCommandLineA
TerminateProcess
Process32Next
GetTempFileNameA
GetLocalTime
OutputDebugStringA
GetProcAddress
GetCurrentThread
Module32Next
LoadLibraryExA
SetErrorMode
LockResource
SizeofResource
LoadResource
FindResourceA
VirtualFreeEx
GetExitCodeThread
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
GetPrivateProfileStringA
GetEnvironmentVariableA
GetExitCodeProcess
SearchPathA
WinExec
HeapAlloc
GetProcessHeap
HeapFree
RemoveDirectoryA
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
ResumeThread
VirtualProtectEx
FreeLibrary
GetWindowsDirectoryA
OpenMutexA
GetModuleFileNameA
CreateProcessA
Sleep
CloseHandle
CreateFileA
GetLastError
FindFirstFileA
FindNextFileA
FindClose
GetSystemDirectoryA
GetTempPathA
DeleteFileA
MoveFileA
GetCurrentProcess
MoveFileExA

user32

FindWindowA
ShowWindow
SendMessageTimeoutA
SendMessageA
FindWindowExA
keybd_event
SetFocus
SetForegroundWindow
DestroyWindow
GetWindowThreadProcessId

advapi32

OpenSCManagerA
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
ControlService
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
RegSetValueExA
RegQueryValueExA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenThreadToken
CloseServiceHandle

shell32

SHGetSpecialFolderPathA

ole32

OleInitialize
OleUninitialize

shlwapi

PathAppendA
PathRemoveFileSpecA
PathCombineA
PathFindFileNameA
SHDeleteValueA
SHSetValueA
PathIsDirectoryA
SHGetValueA
SHDeleteKeyA

setupapi

SetupIterateCabinetA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
_mbslwr
rewind
fgets
strchr
_mbsstr
sscanf
_strnicmp
fread
strcmp
time
srand
rand
_except_handler3
_stricmp
fwrite
strstr
__CxxFrameHandler
_strlwr
isalnum
memmove
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
_vsnprintf
memset
strlen
free
strcpy
malloc
sprintf
_mbsnbcpy
_mbscmp
strcat
_snprintf
atoi
_strdup
strncat
strrchr
strncpy
fclose
ftell
fprintf
fseek
fopen

netapi32

Netbios

urlmon

URLDownloadToFileA

Exports

Exports

DllRegisterServer
DllUnregisterServer
Rundll32
ekfs
ekfsEx

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87dad2acbf7ffb1c937d50e8c97c0758

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

setupapi

version

msvcrt

netapi32

urlmon

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 17KB

.rsrc Size: 220KB - Virtual size: 219KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 17KB

.rsrc
Size: 220KB - Virtual size: 219KB

.reloc
Size: 4KB - Virtual size: 3KB