041ebd55472e90b6539ed5d520c01f99_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

041ebd55472e90b6539ed5d520c01f99_JaffaCakes118
Size

648KB
MD5

041ebd55472e90b6539ed5d520c01f99
SHA1

94cd854b532681dfce63dcd26275ffe735c2cfc2
SHA256

dbe9477ae91c832c2f8749829b9300435efda9299c6dd2b1bd06d49452083827
SHA512

371e5d64c9857b5c417a1080f97911a24c0001d60a989052bafe336264b1a858304f7abb1944de6d799e5e8019c78c32e58103d64dc32ee731cd14e2e33856d7
SSDEEP

12288:ftFeHgffXM9vO6Ca7urSHjoPmWnj+AtPQZwGWXzwjGFiJEvSm6l:fxffXMD7urYinnjvteJWXZievSHl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
041ebd55472e90b6539ed5d520c01f99_JaffaCakes118

Files

041ebd55472e90b6539ed5d520c01f99_JaffaCakes118
.dll windows:6 windows x86 arch:x86

588ce9c482367dbb59e7f2cd11094196

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Grew\Coast\for\big\tall\Mix\earthup.pdb

Imports

kernel32

CreateEventA
VirtualProtectEx
CloseHandle
Sleep
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEndOfFile
HeapSize
WriteConsoleW
SetStdHandle
GetCommandLineW
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
InterlockedFlushSList
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetACP
ReadFile
GetConsoleMode
ReadConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
GetProcessHeap
IsValidCodePage
GetOEMCP
GetVersion

user32

CreateMenu
TranslateMessage
RegisterWindowMessageA
BeginDeferWindowPos
LoadCursorA
DeferWindowPos
UnregisterHotKey

advapi32

SystemFunction036
SetSecurityDescriptorDacl
SetEntriesInAclA
CreateServiceW
RegEnumKeyA
RegCloseKey
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
RegQueryValueExA
AllocateAndInitializeSid
LookupPrivilegeValueA
SetServiceStatus
OpenServiceA
OpenThreadToken
RegOpenKeyExA
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
RegSetValueExA
ControlService
RegCreateKeyExA
OpenSCManagerA
RegisterServiceCtrlHandlerA

winmm

mciSendCommandA
mciGetErrorStringA
PlaySoundA
timeBeginPeriod
timeEndPeriod

comctl32

ImageList_SetDragCursorImage
ImageList_Destroy
ImageList_SetIconSize
ImageList_SetBkColor
ImageList_AddMasked
InitCommonControlsEx
ImageList_Remove

Sections

.text
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 266KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

588ce9c482367dbb59e7f2cd11094196

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

winmm

comctl32

Sections

.text Size: 363KB - Virtual size: 363KB

.rdata Size: 266KB - Virtual size: 266KB

.data Size: 4KB - Virtual size: 76KB

.gfids Size: 1024B - Virtual size: 828B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024B - Virtual size: 1020B

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 363KB - Virtual size: 363KB

.rdata
Size: 266KB - Virtual size: 266KB

.data
Size: 4KB - Virtual size: 76KB

.gfids
Size: 1024B - Virtual size: 828B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024B - Virtual size: 1020B

.reloc
Size: 10KB - Virtual size: 10KB