JaffaCakes118_0ac842768dffbacc1b63605344bd0e6d2cf4b548df5470329dff1bf5c90d33a3

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_0ac842768dffbacc1b63605344bd0e6d2cf4b548df5470329dff1bf5c90d33a3
Size

235KB
MD5

2315647f3730ead1533dab3bc6061441
SHA1

ae62ee729c9071e8a978f42fbf0128a369d733a9
SHA256

0ac842768dffbacc1b63605344bd0e6d2cf4b548df5470329dff1bf5c90d33a3
SHA512

33e8906f1a483285f8fd919cea9f5f9bb9261704ec71a00afa45a16ec4e6661f7985181b9454c9ac7196bdb9a7b76ca6dab8e67b036a602d5c16a37d2d5a9775
SSDEEP

6144:C/oMoCmmjqONHLWeW+3lndM3KBwDb5r+cvqn2k01TNo1j:SYmZZ/G3041y2kio1j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/826ee61b1e74c2d97734ca9a9afbdaca7a162fbea206e851a8923c9b9ecba833

Files

JaffaCakes118_0ac842768dffbacc1b63605344bd0e6d2cf4b548df5470329dff1bf5c90d33a3
.zip

Password: infected
826ee61b1e74c2d97734ca9a9afbdaca7a162fbea206e851a8923c9b9ecba833
.dll regsvr32 windows:6 windows x64 arch:x64

d62a863dca8ca13e4ee99e8a8bf0b8f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\a7M9MJmxo9\QByXUT8R8DM3\k9ILYv\ktaF\6Jg3G5w9Ax\aHCXIr\6vcfM9g\W1oBubSXQ.pdb

Imports

user32

EndDialog
DefWindowProcW
DestroyWindow
EndPaint
BeginPaint
PostQuitMessage
DialogBoxParamW
UpdateWindow
ShowWindow
LoadStringW
RegisterClassExW
LoadIconW
LoadCursorW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
CreateWindowExW

kernel32

GetLocaleInfoW
WriteConsoleW
CreateFileW
HeapSize
SetStdHandle
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
CloseHandle
GetProcessHeap
EnumSystemLocalesW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
WideCharToMultiByte
GetLastError
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LCMapStringW
RtlUnwind
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidLocale
GetUserDefaultLCID

Exports

Exports

?ARaHAtyfA@@YA_NXZ
?BijIduTMZyzAdufQFK@@YA_NXZ
?GzcVeXwFWnYJevkxen@@YA_NXZ
?HshmzUla@@YA_NXZ
?IJevwZKHstmHU@@YA_NXZ
?KrchurQhWLAxaHQpCj@@YA_NXZ
?LAhGrIdWHkNuvwpe@@YA_NXZ
?NCnklWHQVGPcpqHMNa@@YA_NXZ
?NePENaHI@@YA_NXZ
?OfEJejQFSXANCzolm@@YA_NXZ
?RCnglCzUFOLQpmTUBK@@YA_NXZ
?RGPERmXAlqrcBS@@YA_NXZ
?TstSLgFyDYNm@@YA_NXZ
?UxeLkRKLwBGXYJu@@YA_NXZ
?YBaLcVSnotqXEVe@@YA_NXZ
?ZWzMNSLIVGrIpOfkVa@@YA_NXZ
?ZiDIxinkVqvIJqTota@@YA_NXZ
?diLAlqHchKDwFujUFq@@YA_NXZ
?ersRGXYNCPg@@YA_NXZ
?fUpiTUxePkBm@@YA_NXZ
?jEZuvARavYNm@@YA_NXZ
?lOrkxKvcFmjIlePIxW@@YA_NXZ
?liPMNGjoJKzgBGns@@YA_NXZ
?mvkFWTwpeXolKnktGD@@YA_NXZ
?sZunERmzo@@YA_NXZ
?tCTwxizEhOXUBOrUtq@@YA_NXZ
?wparsNmvM@@YA_NXZ
?zEpGzgxyzwZqPk@@YA_NXZ
?zIBmrIROXoNWTU@@YA_NXZ
?zYtuvcRWTIxOfUtuPM@@YA_NXZ
DllRegisterServer
PluginInit

Sections

.text
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

d62a863dca8ca13e4ee99e8a8bf0b8f8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 345KB - Virtual size: 345KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 17KB - Virtual size: 23KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 345KB - Virtual size: 345KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 17KB - Virtual size: 23KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 3KB - Virtual size: 3KB