JaffaCakes118_9a60c0d58867b128d35bb50721b7efb7

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_9a60c0d58867b128d35bb50721b7efb7
Size

371KB
MD5

9a60c0d58867b128d35bb50721b7efb7
SHA1

90f78cf7144ce7a16f7a68ea11f4728b3de3a984
SHA256

258e1c27077f428bc9b8cc543ab51f02b3d69d892f9b25ca5c8e9ca84e5a8876
SHA512

adef12c781b29f33706081bed6394adb973f399e930caa1f7ae9bd6d647a5b2b5869062686a1a11c8eb8baf36989c2d66ca5b967cfa86926eca99f248d4c32b0
SSDEEP

6144:DXiq8OR6oqpFtfa5GGOHYchFDQBYEOix17klwf+hV9/QfoS5:DXiqHGpFtyGGO4jFlx1QlG4VS35

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_9a60c0d58867b128d35bb50721b7efb7

Files

JaffaCakes118_9a60c0d58867b128d35bb50721b7efb7
.dll windows:5 windows x86 arch:x86

4cd3aff284b6ce326fb6d28fae8084c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

iswupper
toupper
isxdigit
isdigit
isalnum
_onexit
??3@YAXPAX@Z
swprintf
_ui64tow
_i64tow
strspn
strcspn
isalpha
__dllonexit
_adjust_fdiv
_initterm
_vsnwprintf
_wcsicmp
_strlwr
_strupr
wcscmp
wcschr
memchr
towlower
wcsncmp
memmove
vswprintf
wcsrchr
calloc
strncpy
strtoul
strchr
sprintf
_except_handler3
_snprintf
_beginthreadex
qsort
srand
wcstok
wcstoul
wcsstr
_ltow
wcstol
iswcntrl
wcspbrk
_wcsdup
_vsnprintf
_ultoa
__CxxFrameHandler
_ultow
rand
wcsncpy
swscanf
_snwprintf
_ltoa
_ftol
strpbrk
_strnicmp
sscanf
strncmp
isspace
tolower
strstr
_wtoi
_atoi64
iswspace
_wtol
wcsftime
gmtime
time
_stricmp
iswxdigit
atoi
iswalpha
iswdigit
_wcsnicmp
towupper
wcslen
_purecall
??2@YAPAXI@Z
realloc
free
malloc
strrchr

tapi32

lineNegotiateAPIVersion
lineGetDevCaps
lineOpen
lineInitialize
lineGetID
lineShutdown
lineClose

ws2_32

WSAEnumNetworkEvents
WSAEventSelect

crypt32

CryptProtectData
CryptUnprotectData

kernel32

CreateEventA
CreateEventW
CreateFileA
CreateFileW
CreateSemaphoreA
DeleteFileA
DeleteFileW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FindResourceA
FindResourceW
LocalFree
LocalAlloc
FormatMessageA
FormatMessageW
GetFileAttributesA
GetFileAttributesW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
lstrcpynW
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
lstrcatW
lstrcmpiA
lstrcmpiW
lstrcpyW
IsBadWritePtr
GetVersionExW
GetLocaleInfoA
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetWindowsDirectoryW
GetShortPathNameA
GetShortPathNameW
GetComputerNameA
GetComputerNameW
GetSystemDirectoryA
OpenMutexA
OpenMutexW
SearchPathA
SearchPathW
FreeLibraryAndExitThread
SetThreadPriority
GetCurrentThread
GetSystemInfo
InterlockedCompareExchange
WaitForSingleObjectEx
HeapSize
ReleaseSemaphore
Sleep
VirtualFree
VirtualAlloc
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
SetThreadAffinityMask
GetExitCodeThread
GetSystemDefaultLCID
SetFilePointer
SetEndOfFile
GetLocalTime
ReadFile
GetFileSize
GetStdHandle
SystemTimeToFileTime
GetExitCodeProcess
OpenProcess
GetThreadLocale
FileTimeToSystemTime
QueryPerformanceFrequency
DeviceIoControl
GetCommConfig
GetVersion
CreateDirectoryW
CreateDirectoryA
CopyFileW
CopyFileA
SetLastError
GetModuleHandleA
GetWindowsDirectoryA
lstrlenW
GetVersionExA
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LockResource
WriteFile
FreeResource
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
GetCurrentThreadId
InterlockedExchange
WaitForSingleObject
ResetEvent
CloseHandle
GetLastError
LoadResource
SizeofResource
lstrlenA
DisableThreadLibraryCalls
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
CompareFileTime
WaitForMultipleObjects
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateThread
LoadLibraryW
GetSystemTime

user32

RegisterWindowMessageA
SetWindowLongA
wvsprintfW
CharNextW
PostQuitMessage
DestroyWindow
GetMessageA
DispatchMessageA
DefWindowProcA
CreateWindowExA
RegisterClassA
PostMessageA
GetWindowLongA

advapi32

RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegEnumKeyA
RegEnumKeyW
IsTextUnicode
DeregisterEventSource
RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegEnumValueW
RegEnumValueA

ole32

CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
CLSIDFromString
CoCreateGuid
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize

wininet

InternetTimeToSystemTimeW
InternetTimeToSystemTimeA
InternetGetCookieW
InternetGetCookieA
InternetSetCookieW
InternetSetCookieA

shell32

SHGetSpecialFolderPathA

version

GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoA

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 269KB - Virtual size: 697KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4cd3aff284b6ce326fb6d28fae8084c8

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

tapi32

ws2_32

crypt32

kernel32

user32

advapi32

ole32

wininet

shell32

version

Sections

.text Size: 52KB - Virtual size: 49KB

.data Size: 269KB - Virtual size: 697KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 52KB - Virtual size: 49KB

.data
Size: 269KB - Virtual size: 697KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 14KB - Virtual size: 14KB