eb6098ef930a261aa5335c029cc08308_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eb6098ef930a261aa5335c029cc08308_JaffaCakes118
Size

62KB
MD5

eb6098ef930a261aa5335c029cc08308
SHA1

595438f960fa80e55b9926736e6e2e0b4f4d8151
SHA256

b41e9101292ffa21cb5991dc0cb0bf4c8e06208822c035d5ecfd4d1c7d37c432
SHA512

f4dcf1fe1cbcd5afc02da0a87d7cedfea8cbdde96436fe4a057ec998f434bfeceb8cd6ae70b9953be2b49739c6e5a33587e4c8b0c38ee6d4cde317fb399eec08
SSDEEP

768:gqv8bNiAF8aRfVzms4GBr1eTSA9vC61NxUwQ0/e8pNWNBNzNh2i:rUbJF9tzm21eTSW2wQ0/e8Q31V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb6098ef930a261aa5335c029cc08308_JaffaCakes118

Files

eb6098ef930a261aa5335c029cc08308_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e594ed179b6156bf36dee07c5a3f7f43

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\Project\!lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb

Imports

ws2_32

WSAEventSelect

kernel32

GetTickCount
GetProcessHeap
WriteFile
InitializeCriticalSection
WideCharToMultiByte
Sleep
SizeofResource
CreateEventA
LeaveCriticalSection
ReadFile
GetSystemDirectoryA
lstrcatA
lstrcmpW
MultiByteToWideChar
lstrlenW
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
SetEvent
GetPrivateProfileStringA
LoadLibraryA
LockResource
WaitForMultipleObjects
GetModuleFileNameA
lstrcatW
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
GetTempPathA
LocalFree
RtlUnwind
DeleteFileA
CreateThread
lstrcpyA
HeapFree
InterlockedDecrement
InterlockedIncrement
HeapAlloc
CreateProcessW
LoadResource
FreeLibrary
lstrcpynA
lstrlenA
FreeResource
SetFilePointer
lstrcmpA
FindResourceA
GetFileSize
CreateFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTempFileNameA
lstrcpyW

advapi32

RegOpenKeyExA
CryptHashData
RegCloseKey
CryptDestroyHash
RegEnumValueA
CryptCreateHash
RegDeleteValueA
CryptGetHashParam
CryptAcquireContextA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
CryptReleaseContext
RegQueryValueExA
RegSetValueExA

user32

IsCharAlphaNumericA
DispatchMessageA
CharLowerA
wsprintfA
SetTimer
GetMessageA

ole32

CoInitialize
CoCreateInstance

oleaut32

SysFreeString
VariantInit
SysAllocString
SysAllocStringLen

shlwapi

StrStrA

shell32

SHGetFolderPathA

urlmon

URLDownloadToFileW

crypt32

CryptUnprotectData

Exports

Exports

NSPStartup

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e594ed179b6156bf36dee07c5a3f7f43

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

user32

ole32

oleaut32

shlwapi

shell32

urlmon

crypt32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 47KB

.data Size: 512B - Virtual size: 912B

.CRT Size: 512B - Virtual size: 8B

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 47KB - Virtual size: 47KB

.data
Size: 512B - Virtual size: 912B

.CRT
Size: 512B - Virtual size: 8B

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 2KB - Virtual size: 2KB