0894ddc04b31fd1449db51b1e91ad700_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0894ddc04b31fd1449db51b1e91ad700_JaffaCakes118
Size

212KB
MD5

0894ddc04b31fd1449db51b1e91ad700
SHA1

e7c9a825d547a0e6ccb2654b9f37adc0f10e9143
SHA256

30c53323612415600f56a22b3c61b79547d90cf9bf201a1a98e8165c43eb6cef
SHA512

c76ead085d659524d6d2bf36ee1db25686952861673fc258e41a8b0123953861dd5abb113f8893fcb29e8494d373fb7fda918c34de9cfd10f3b3a5ddec9b49be
SSDEEP

3072:HAn4Unzu9WdStnuKWOqdO5bd0X1+Snofmb2kBUsyOhL6m0W0piw1ax:gn/qu5B17oi2k7Jh+mXsax

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0894ddc04b31fd1449db51b1e91ad700_JaffaCakes118

Files

0894ddc04b31fd1449db51b1e91ad700_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a438cec4e397b56f6067e7887d8ff6e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
LoadLibraryExW
GetCurrentProcessId
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetVersionExW
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeW
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSection
LoadLibraryA
GetLocaleInfoA
GetStringTypeA

gdi32

ExtEscape
DeleteDC
CreateDCW

winspool.drv

OpenPrinterW
ClosePrinter
EnumPrintersW
GetPrinterW
GetPrinterDriverW
DocumentPropertiesW
DeviceCapabilitiesW

Exports

Exports

MPNCreateDC
MPNCreatePrinterManager
MPNEnumItem
MPNEnumItemValue
MPNGetDefaultItemValue
MPNGetDevMode
MPNGetItemValue
MPNGetItemValueNameA
MPNGetItemValueNameW
MPNGetPortNameA
MPNGetPortNameW
MPNGetPrinter
MPNGetPrinterCount
MPNGetPrinterHandle
MPNGetPrinterNameA
MPNGetPrinterNameW
MPNIsExtDDI
MPNIsSupportItem
MPNIsSupportItemValue
MPNPrinterInitializeA
MPNPrinterInitializeW
MPNPrinterRelease
MPNPrinterShowProperty
MPNRefreshPrinterManager
MPNReleasePrinterManager
MPNSetDefaultValue
MPNSetItemValue
MPNSetItemValuePriority

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a438cec4e397b56f6067e7887d8ff6e5

Headers

File Characteristics

Imports

kernel32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 8KB - Virtual size: 5KB

.text Size: 128KB - Virtual size: 128KB

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 128KB - Virtual size: 128KB