fe801e920e34eb888aa1e432679103b2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fe801e920e34eb888aa1e432679103b2_JaffaCakes118
Size

519KB
MD5

fe801e920e34eb888aa1e432679103b2
SHA1

edda7eb90b684ddf5fd2dad989f84cc27f428d5b
SHA256

fddb7a1b9157a178a0e7f3d5c45e13749bbcc2eee8dbdc5a1dd55bc50962ff78
SHA512

7aecd90ab2939f2923075e84dcaba3d8c86dfb75a2c8492ec6c28b3edbb1d054971df4b9b34eb0ac20326dfb1db005f41b40aa089f5f59802cbaba082dfb2185
SSDEEP

12288:Cbz+LOIuCCUev39lCahIcz33jSXXs8bLeyR1ix7yLru7a:Cbz+LOIuCCUev3HCaicL32Xdyx7yLru7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe801e920e34eb888aa1e432679103b2_JaffaCakes118

Files

fe801e920e34eb888aa1e432679103b2_JaffaCakes118
.dll windows:6 windows x86 arch:x86

e27fa0d43e5b57c6ad0065e5bfc50b7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msimg32

TransparentBlt
GradientFill

version

VerFindFileW

imm32

ImmInstallIMEA

shlwapi

StrRChrW

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

ws2_32

htonl
WSAAsyncGetProtoByNumber
WSACancelAsyncRequest

kernel32

GetProcessHeap
ReadFile
GetCurrentProcess
GetModuleFileNameW
WaitForMultipleObjects
CreateMutexW
GetVolumeInformationA
WaitForSingleObject
CreateFileW
GetVersionExW
ReleaseMutex
UnmapViewOfFile
SetCurrentDirectoryA
CreateEventW
Sleep
GetLastError
CreateFileA
SetEvent
GetSystemDirectoryA
SetStdHandle
CloseHandle
CreateThread
GetFileSize
ExitProcess
GetModuleHandleW
FreeLibrary
GetSystemTimeAsFileTime
CreateFileMappingW
CreateEventA
MapViewOfFile
GetTickCount
IsWow64Process
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
FlushFileBuffers
WriteFile
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
GetProcAddress
GetConsoleCP
WriteConsoleW
LoadLibraryA
QueryPerformanceCounter
IsValidCodePage
FindNextFileA
DecodePointer
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RaiseException
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
LCMapStringW
GetACP
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetStringTypeW
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExA

user32

LoadIconW
WindowFromPoint
SendMessageW
MessageBoxW
GetDC
ReleaseDC

comdlg32

GetFileTitleA

advapi32

GetSecurityDescriptorDacl
RegCloseKey
RegQueryValueExA
AllocateAndInitializeSid
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCreateKeyExA
OpenProcessToken
FreeSid
CheckTokenMembership
GetTokenInformation

shell32

ShellExecuteExW

oleaut32

VarI1FromDate

Exports

Exports

ServiceMain
kf_bfly4
mcobject_init
mycore_string_length
mycore_utils_mhash_search_mycore_strncasecmp_mcsync_lock_mycore_string_clean_all
mythread_queue_node_malloc_limit_avl_tree_test_delete_10_0_avl_tree_test_3_0_mcobject_init

Sections

.text
Size: 461KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e27fa0d43e5b57c6ad0065e5bfc50b7a

Headers

DLL Characteristics

File Characteristics

Imports

msimg32

version

imm32

shlwapi

winmm

ws2_32

kernel32

user32

comdlg32

advapi32

shell32

oleaut32

Exports

Exports

Sections

.text Size: 461KB - Virtual size: 460KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 3KB - Virtual size: 340KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 461KB - Virtual size: 460KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 3KB - Virtual size: 340KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 15KB - Virtual size: 14KB