550bbb5693887738e28955cea4497308_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

550bbb5693887738e28955cea4497308_JaffaCakes118
Size

73KB
MD5

550bbb5693887738e28955cea4497308
SHA1

b1e9a54702dd55283706e13487fa23da772c10bb
SHA256

6e832819a858afd9319f2cd975a99183505bab00f7cea0492b943c2ebb66c95b
SHA512

efd56fd2490c559413e17546e1c6ca14a30005031b87c330ebcf6122a31eea3ae2952e57479967ff92448eb490cbf1f0695873b6251e859cebad5aded5a400d8
SSDEEP

1536:b6JVhQ54ryQHnRje7KuSvJaBOg4ZD/KbK9ozMXqD8lDaLFFAZWhE68:8hQ8RTVhBg4ZGb+ozmqDXLFFZE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
550bbb5693887738e28955cea4497308_JaffaCakes118

Files

550bbb5693887738e28955cea4497308_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1fcc579d15e4d763c042b7e19170ed67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
UnhandledExceptionFilter
RtlUnwind
RaiseException
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
WriteProcessMemory
WriteFile
WaitForSingleObject
VirtualProtect
VirtualAllocEx
TerminateProcess
SystemTimeToFileTime
Sleep
SetProcessShutdownParameters
ResumeThread
ReadFile
OpenProcess
GetSystemTime
GetProcAddress
GetCurrentProcessId
GetCurrentProcess
CreateThread
CreateProcessW
ConnectNamedPipe
CloseHandle
lstrlenA
lstrcpyA
lstrcatA
LoadLibraryA
GetWindowsDirectoryA
GetTempPathA
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
CreateProcessA
CreateNamedPipeA
CreateFileA
CreateToolhelp32Snapshot
Thread32Next
Thread32First
Module32Next
Module32First
Process32Next
Process32First
OpenThread
VirtualProtect
GetModuleFileNameA
ExitProcess

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

advapi32

RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyA
RegEnumKeyExA
RegCloseKey
OpenProcessToken
GetTokenInformation
CreateProcessAsUserW
AdjustTokenPrivileges
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
LookupPrivilegeValueA

gdi32

GetStockObject

user32

CreateWindowExW
keybd_event
UpdateWindow
TrackPopupMenu
SetWindowTextW
SetWindowPos
SetWindowLongW
SetFocus
SendMessageW
MessageBoxW
GetWindowTextW
GetWindowRect
GetParent
GetWindow
GetNextDlgTabItem
GetCursorPos
GetClientRect
ExitWindowsEx
DestroyWindow
DestroyMenu
CreatePopupMenu
CheckMenuRadioItem
AppendMenuW
SetWindowTextA
SetWindowLongA
SendMessageA
GetWindowTextA
GetWindowLongA
FindWindowExA
CallWindowProcA
MessageBoxA

ntdll

NtQueueApcThread

Exports

Exports

WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncSelect
WSACancelAsyncRequest
WSACancelBlockingCall
WSACleanup
WSAGetLastError
WSAIsBlocking
WSASetBlockingHook
WSASetLastError
WSAStartup
WSAUnhookBlockingHook
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getpeername
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
nts
ntsclean
ntskd
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

CODE
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1fcc579d15e4d763c042b7e19170ed67

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

gdi32

user32

ntdll

Exports

Exports

Sections

CODE Size: - Virtual size: 20KB

DATA Size: - Virtual size: 188B

BSS Size: - Virtual size: 2KB

.idata Size: - Virtual size: 2KB

.edata Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 728B

.vmp1 Size: - Virtual size: 28KB

.vmp2 Size: 71KB - Virtual size: 70KB

.reloc Size: 512B - Virtual size: 68B

CODE
Size: - Virtual size: 20KB

DATA
Size: - Virtual size: 188B

BSS
Size: - Virtual size: 2KB

.idata
Size: - Virtual size: 2KB

.edata
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 728B

.vmp1
Size: - Virtual size: 28KB

.vmp2
Size: 71KB - Virtual size: 70KB

.reloc
Size: 512B - Virtual size: 68B