b3a3238bbc1d2e777bba0ca5ef313c9c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b3a3238bbc1d2e777bba0ca5ef313c9c_JaffaCakes118
Size

721KB
MD5

b3a3238bbc1d2e777bba0ca5ef313c9c
SHA1

f4009c30d1bd40bbaa0cee4677f95837cce11664
SHA256

65b2f5308d92982c01f6e5bf0c96d8231f11fa8d57a69a6295416738dfb28944
SHA512

b655b1ce1d4b59145670025cb079a8e26e89209d3cbc1e2783c7b9b7249cb4506974a80fad16f3b468e096e40c19c78ac905c684ea596b7c4f6497ea5a48693e
SSDEEP

12288:WJPlkiF7SXN5QtXMaPm2z9aa8SeC5uuepRq74/9/kMSOcpFz1G:WdlkilSXN5QtXMaOCvez9/kMSO01

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3a3238bbc1d2e777bba0ca5ef313c9c_JaffaCakes118

Files

b3a3238bbc1d2e777bba0ca5ef313c9c_JaffaCakes118
.dll windows:6 windows x86 arch:x86

42f9c959dae6427c042e12f14923f27b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\SmoK\Desktop\astrohook with sum stuff removed\Release\uff$$ gang.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryA
GlobalAlloc
GlobalUnlock
GlobalLock
CreateThread
Sleep
VirtualProtect
HeapAlloc
GetProcessHeap
VirtualQuery
IsBadReadPtr
GetSystemTimeAsFileTime
GetCurrentThreadId
WritePrivateProfileStringA
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
GetPrivateProfileStringA
CreateDirectoryA
K32GetModuleInformation
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
InitializeSListHead
GetProcAddress
GetCurrentProcessId
GetCurrentProcess

user32

FindWindowA
GetAsyncKeyState
SetWindowLongA
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetCursor
GetClientRect
GetKeyState
GetCursorPos
CallWindowProcA

advapi32

RegEnumValueA
RegOpenKeyExA
RegCloseKey

shell32

SHGetFolderPathA

msvcp140

?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?_Xlength_error@std@@YAXPBD@Z
?width@ios_base@std@@QBE_JXZ
_Xtime_get_ticks
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z

winmm

PlaySoundA

imm32

ImmGetContext
ImmSetCompositionWindow

vcruntime140

_except_handler4_common
__current_exception_context
__current_exception
strchr
memchr
memcmp
strstr
memmove
memcpy
__CxxFrameHandler3
__std_type_info_destroy_list
memset
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall

api-ms-win-crt-string-l1-1-0

strncpy
isprint
wcslen
strlen
_strnicmp
strcmp
_stricmp
strcpy

api-ms-win-crt-math-l1-1-0

sqrt
sin
fabs
floor
ceil
pow
fmaxf
fmod
copysignf
roundf
_fdtest
atan2
cos
acos

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_wassert
_initterm_e
_initterm
terminate
_cexit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-convert-l1-1-0

atoi
atof
mbstowcs_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_wfopen
fclose
fflush
fread
fseek
ftell
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vsprintf_s

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

Sections

.text
Size: 490KB - Virtual size: 490KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42f9c959dae6427c042e12f14923f27b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

msvcp140

winmm

imm32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 490KB - Virtual size: 490KB

.rdata Size: 138KB - Virtual size: 137KB

.data Size: 66KB - Virtual size: 296KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 490KB - Virtual size: 490KB

.rdata
Size: 138KB - Virtual size: 137KB

.data
Size: 66KB - Virtual size: 296KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 25KB - Virtual size: 24KB