8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118
Size 712KB
Sample240602-2g1vcsaf34
SHA256 b9cbfb6650c9e595c84534ed6baedf721f8a35462e4b76a11b394ad092486fe8
MD5 8fab6f87c08103ea90f7e080ffd13eb2
SHA1 fa909952026ef051d27f278746c4b21a761bd90e
SHA512 b06295983b198e8d71002f5d84985b88baa26db222a6dd9e084a33831ce7718a41889cb88fdd2f92860a25f55b133c1f7db98a441a17865fdd289d2cf68b3429
SSDEEP 12288:SYdCRC6FC/ul3QGWBDM5kWP2ibBxOLF9YYY6JTxk5cEGOt:SsCC/ulAGODM5zP2ibBxOLF/JTxk8W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118

File Explorer

8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118

.dll 712KB

8fab6f87c08103ea90f7e080ffd13eb2_JaffaCakes118

IMPHASH a076cc35e72e813760f271c2e063ccbb
SHA256 b9cbfb6650c9e595c84534ed6baedf721f8a35462e4b76a11b394ad092486fe8
MD5 8fab6f87c08103ea90f7e080ffd13eb2
SHA1 fa909952026ef051d27f278746c4b21a761bd90e
SHA512 b06295983b198e8d71002f5d84985b88baa26db222a6dd9e084a33831ce7718a41889cb88fdd2f92860a25f55b133c1f7db98a441a17865fdd289d2cf68b3429
SSDEEP 12288:SYdCRC6FC/ul3QGWBDM5kWP2ibBxOLF9YYY6JTxk5cEGOt:SsCC/ulAGODM5zP2ibBxOLF/JTxk8W
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

260360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\temp\vcobj\EdmPoliPlay\Poli_PlaySDK.pdb

kernel32

CreateEventA ResumeThread SetFilePointer SetEvent TerminateThread WaitForSingleObject MoveFileExA OutputDebugStringA GetLastError LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateFileA LocalAlloc WriteFile CloseHandle WaitForMultipleObjects LocalFree IsProcessorFeaturePresent GetModuleHandleA WideCharToMultiByte FreeLibrary GetProcessHeap HeapFree GetCurrentProcess HeapAlloc GetModuleFileNameA DisableThreadLibraryCalls DebugBreak LoadLibraryA GetProcAddress GetVersionExA RaiseException GetSystemInfo

user32

GetClientRect InvalidateRect DrawTextW DrawTextA MessageBoxA

msvcr71

__CxxFrameHandler ?terminate@@YAXXZ __CppXcptFilter _adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ strncmp sscanf vsprintf free malloc _ftol srand rand _except_handler3 _endthreadex _beginthreadex ??0exception@@QAE@XZ ??1exception@@UAE@XZ localtime _snprintf _vsnprintf exit _CxxThrowException ??0exception@@QAE@ABV0@@Z memmove _purecall ??3@YAXPAX@Z ??2@YAPAXI@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z memset _ftime _CIacos _finite floor

msvcp71

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ

d3d9

Direct3DCreate9

gdi32

SelectObject SetTextColor SetBkColor DeleteDC CreateDIBSection CreateCompatibleDC CreateFontIndirectA DeleteObject SetBkMode GetStockObject GetObjectA

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyA

Name

.text

Size

392KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=25, version=9210,

count=1, id=28, version=9178,

count=9, id=95, version=2067,

count=6, id=18, version=8444,

count=116, id=29, version=9178,

count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=105, version=2067,

count=4, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=8, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=9, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=31, productName=Unmarked objects (old),

count=32, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=95, version=2179,

count=2, id=93, version=2067,

count=7, id=93, version=2179,

count=240, id=1, productName=Unmarked objects,

count=4, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=92, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,