55b0febe5427ed6ea9a9e0676bb91396_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

55b0febe5427ed6ea9a9e0676bb91396_JaffaCakes118
Size

424KB
MD5

55b0febe5427ed6ea9a9e0676bb91396
SHA1

451b8ad3f5a3196d0a3907aa6fd82a0941f19c43
SHA256

c5d8184885c5a3b8e975415f3794c6651767d7546de9fbac39dd72a027dc07dc
SHA512

7ee159110e1832db7caedbe973ac803a19e308fa532423419321d216b8f755f51c1a735dce9c6bf53fedf537579eb6c6059a4111ec43f4ddffbc72707bb8a4b3
SSDEEP

12288:+kPFmiUWE15RMXQSjcJFAo0PbO4NTzwUd3eifV/bHy8sm+:OrEeejOATzwUd3XfV/bH1sm+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55b0febe5427ed6ea9a9e0676bb91396_JaffaCakes118

Files

55b0febe5427ed6ea9a9e0676bb91396_JaffaCakes118
.dll windows:0 windows x86 arch:x86

6b39d07012989ced7342e84a7aaa0c0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

strcat
strncat
_strnicmp
strstr
strtol
strtoul
_strcmpi
rand
srand
_time64
rename
_gmtime64
sscanf
_atoi64
strncmp
memchr
_wfopen
_wremove
isalnum
tolower
fgets
_mkdir
_rmdir
atoi
_wstat64
strcmp
_vsnprintf
strcpy
fwrite
strrchr
strcspn
_localtime64
fseek
fclose
isxdigit
isspace
strchr
sprintf
_lrotr
_lrotl
strlen
_CxxThrowException
_fileno
realloc
__CxxFrameHandler
_onexit
__dllonexit
_unlock
_lock
_snprintf
strftime
isdigit
calloc
_amsg_exit
_initterm
free
malloc
_XcptFilter
??1type_info@@UAE@XZ
memmove
qsort
fread
strncpy
memset
_wcsicmp
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
wcscpy
wcslen
wcsncpy
_snwprintf
memcmp
wcscat
_errno
isprint
_strtoi64

ntdll

NtQueryValueKey
ZwOpenKey
RtlCompareMemory
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
NtClose
NtUnmapViewOfSection
NtMapViewOfSection
RtlInitUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
NtQueryInformationProcess
RtlFreeAnsiString
ZwQueryInformationProcess
NtSetValueKey
NtOpenProcess
RtlUnwind
NtCreateSection

ws2_32

ntohl
htonl
ioctlsocket
connect
shutdown
socket
closesocket
gethostbyname
recv
send
select
inet_addr
htons
__WSAFDIsSet
WSAStartup

shlwapi

PathAppendW
PathRemoveBackslashW
StrStrIA
PathRemoveFileSpecW
PathAddBackslashW

advapi32

SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
EqualSid
CreateWellKnownSid
QueryServiceConfigW
ControlService
QueryServiceStatusEx
ChangeServiceConfigW
StartServiceW
LookupAccountSidW
LookupAccountNameW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryValueExW
AdjustTokenPrivileges
CheckTokenMembership
LookupPrivilegeValueA
DuplicateToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken

netapi32

NetShareEnum
NetUserGetLocalGroups
NetQueryDisplayInformation
NetApiBufferFree
NetLocalGroupAddMembers
NetServerEnum

shell32

SHGetFolderPathW
ShellExecuteExW
SHFileOperationW
ShellExecuteW

kernel32

ReadFile
WriteFile
SetThreadContext
SetWaitableTimer
GetFileSizeEx
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
GetVersionExW
SetLastError
Module32FirstW
Module32NextW
MapViewOfFile
UnmapViewOfFile
ConnectNamedPipe
CreateNamedPipeW
CreatePipe
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
GetThreadContext
EnterCriticalSection
GetFileAttributesW
GetLogicalDrives
SetHandleInformation
FlushFileBuffers
FlushViewOfFile
SetFilePointerEx
SetEndOfFile
CreateFileMappingW
DisconnectNamedPipe
LeaveCriticalSection
CreateProcessW
GetLastError
OpenMutexW
CreateMutexW
ResumeThread
SuspendThread
LocalFree
DeleteCriticalSection
ResetEvent
CreateEventA
TlsAlloc
TlsGetValue
TlsSetValue
GetFileSize
FindFirstFileW
GetModuleHandleW
CreateRemoteThread
CreateFileW
GetTempPathW
FindClose
SetEnvironmentVariableA
FindNextFileW
GetWindowsDirectoryW
VirtualAlloc
VirtualFree
VirtualProtectEx
LoadLibraryW
OutputDebugStringA
GetCurrentProcessId
GetVolumeNameForVolumeMountPointW
DuplicateHandle
OpenEventW
GetModuleFileNameA
ProcessIdToSessionId
GetCommandLineA
GetTickCount
InitializeCriticalSection
Sleep
TerminateProcess
lstrlenW
MoveFileW
CreateEventW
WaitForMultipleObjects
CloseHandle
DeleteFileW
CreateThread
InterlockedDecrement
CreateDirectoryW
OpenProcess
ReadProcessMemory
FlushInstructionCache
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
WriteProcessMemory
InterlockedIncrement
InterlockedExchange
WaitForSingleObject
GetSystemDirectoryW
SetErrorMode
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcess
SetEvent

user32

CloseDesktop
CreateDesktopW
SetThreadDesktop
GetThreadDesktop
CharUpperW
wsprintfW

ole32

CoCreateInstance
CoInitializeSecurity
CoInitialize
CoTaskMemFree
CoInitializeEx
CoGetObject
CLSIDFromString
StringFromGUID2
CoSetProxyBlanket
CoUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

imagehlp

CheckSumMappedFile

Sections

.text
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b39d07012989ced7342e84a7aaa0c0e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

ws2_32

shlwapi

advapi32

netapi32

shell32

kernel32

user32

ole32

oleaut32

imagehlp

Sections

.text Size: 249KB - Virtual size: 249KB

code Size: 8KB - Virtual size: 7KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 79KB - Virtual size: 83KB

.reloc Size: 46KB - Virtual size: 48KB

.text
Size: 249KB - Virtual size: 249KB

code
Size: 8KB - Virtual size: 7KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 79KB - Virtual size: 83KB

.reloc
Size: 46KB - Virtual size: 48KB