35f3fc9b7241fc536be2c2eea116345c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

35f3fc9b7241fc536be2c2eea116345c_JaffaCakes118
Size

27KB
MD5

35f3fc9b7241fc536be2c2eea116345c
SHA1

4fbfe8ed845a21d611d9ec3e6ec92260b97722eb
SHA256

8b20fb2c4e7db0cf5d54769a1750200999063d2e77df52739f54dd5305ccfde8
SHA512

c4c5357963ce19d10a2d62397363a3b6bbecd32edb1fb7036a446fb0c79f32379fa47370e938e8f8aa9a2d1d40204c686418c4821b3244658c3972727b5c8042
SSDEEP

768:e3yCxMVztd4YN6Hl7HuhbfYnSTG1NS2B7D9j:eCoIIYN6HkDYnSTG1NSS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35f3fc9b7241fc536be2c2eea116345c_JaffaCakes118

Files

35f3fc9b7241fc536be2c2eea116345c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3fdcae6a8ec0d1b697a0e20bc9219eaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

mfc42u

ord825

msvcrt

free

advapi32

RegOpenKeyA

ole32

CoCreateInstance

user32

GetFocus

Exports

Exports

ClearEventData
ConvertHexStringToWString
ConvertWStringToHexString
CreateBlob
CreateNPPInterface
DestroyBlob
DuplicateBlob
FilterNPPBlob
FindOneOf
FindUnknownBlobCategories
FindUnknownBlobTags
GetBoolFromBlob
GetClassIDFromBlob
GetDwordFromBlob
GetMacAddressFromBlob
GetNPPAddress2FilterFromBlob
GetNPPAddressFilterFromBlob
GetNPPBlobFromUI
GetNPPBlobTable
GetNPPEtypeSapFilter
GetNPPMacTypeAsNumber
GetNPPPatternFilterFromBlob
GetNPPTriggerFromBlob
GetNetworkInfoFromBlob
GetStringFromBlob
GetStringsFromBlob
GetWStringFromBlob
IsRemoteNPP
LockBlob
MarshalBlob
MergeBlob
NmAddUsedEntry
NmHeapAllocate
NmHeapFree
NmHeapReallocate
NmHeapSetMaxSize
NmHeapSize
NmRemoveUsedEntry
RaiseNMEvent
ReadBlobFromFile
RegCreateBlobKey
RegOpenBlobKey
ReleaseEventSystem
RemoveFromBlob
SelectNPPBlobFromTable
SendEvent
SetBoolInBlob
SetClassIDInBlob
SetDwordInBlob
SetMacAddressInBlob
SetNPPAddress2FilterInBlob
SetNPPAddressFilterInBlob
SetNPPEtypeSapFilter
SetNPPPatternFilterInBlob
SetNPPTriggerInBlob
SetNetworkInfoInBlob
SetStringInBlob
SetWStringInBlob
SubkeyExists
UnMarshalBlob
UnlockBlob
WriteBlobToFile
WriteCrackedBlobToFile
recursiveDeleteKey
setKeyAndValue

Sections

.MPRESS1
Size: 20KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3fdcae6a8ec0d1b697a0e20bc9219eaa

Headers

File Characteristics

Imports

kernel32

mfc42u

msvcrt

advapi32

ole32

user32

Exports

Exports

Sections

.MPRESS1 Size: 20KB - Virtual size: 56KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.MPRESS1
Size: 20KB - Virtual size: 56KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB