0e6aafd89cd6e2b0a972d7c559b61e41_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e6aafd89cd6e2b0a972d7c559b61e41_JaffaCakes118
Size

225KB
MD5

0e6aafd89cd6e2b0a972d7c559b61e41
SHA1

ba1f2ddc6bd0ccd5172f0dacc62e0099ee7e91bb
SHA256

6ff32dee062e2d6908c0c25cdf45d4a520a66e0cb85df3c40ab2ce5dd499b43d
SHA512

86e2fc6acc3194399bfa59a141692f50c287006157ce75b18ec78ac30ded4b13fa49d9918a3edc3c369bb61ae39b87e03350e80d5bc1034894eb378042db9c02
SSDEEP

1536:Oxkmxm6QedvGbXoegAyn09TjBNgkILbnPuKj+kQ4+UFomGPKrQ4+UFomGPK/wg+V:OxVu7ouPZjBNgkuqgP+Ju+JSwuhdn8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e6aafd89cd6e2b0a972d7c559b61e41_JaffaCakes118

Files

0e6aafd89cd6e2b0a972d7c559b61e41_JaffaCakes118
.exe windows:4 windows x86 arch:x86

40faca88170864c886744d1f7718d10c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\src\rpbgrecorder\RecordingManager.pdb

Imports

ole32

StringFromCLSID
CoTaskMemFree

kernel32

DeleteFileA
CreateFileA
GetModuleFileNameA
CreateDirectoryA
MoveFileA
GetTickCount
GetSystemInfo
GetVersion
SetProcessWorkingSetSize
GetCurrentProcess
SetUnhandledExceptionFilter
SetCurrentDirectoryA
GetCurrentDirectoryA
SetErrorMode
WaitForSingleObject
GetVersionExA
CreateEventA
LocalFree
SetEvent
WaitForMultipleObjects
WriteFile
GetThreadContext
VirtualQuery
IsBadWritePtr
GetCurrentProcessId
OpenProcess
SetFilePointer
GlobalMemoryStatus
CreateProcessA
Sleep
LoadLibraryExW
lstrlenW
LoadLibraryExA
LoadLibraryW
FreeLibraryAndExitThread
GetSystemDirectoryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoA
ExitProcess
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
SetLastError
VirtualProtect
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
CreateMutexA
GetLastError
CloseHandle
ReleaseMutex
GetModuleHandleA
TerminateThread
IsBadReadPtr

user32

SetLastErrorEx
GetWindowPlacement
SystemParametersInfoA
IsIconic
SetForegroundWindow
AttachThreadInput
GetDC
ReleaseDC
CharNextA
GetSystemMetrics
GetWindowThreadProcessId
DestroyMenu
DestroyIcon
GetSubMenu
MessageBoxA
IsWindow
SetMenuDefaultItem
FindWindowA
SendMessageA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
RegisterWindowMessageA
DefWindowProcA
PostMessageA
GetForegroundWindow

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyA
RegEnumKeyExA
RegSetValueExA
FreeSid
RegQueryValueA
RegDeleteValueA
RegOpenKeyExA
RegSetValueA

version

GetFileVersionInfoA
VerQueryValueA

gdi32

GetDeviceCaps

msvcp71

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

msvcr71

__CxxFrameHandler
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
time
gmtime
asctime
vsprintf
strncpy
_mbctype
_strcmpi
strrchr
getenv
_callnewh
__security_error_handler
_except_handler3
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_vsnprintf
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_putenv
_controlfp
_purecall
??3@YAXPAX@Z
strchr
printf
_stricmp
strstr
??_V@YAXPAX@Z
atoi
memmove
malloc
free
realloc
_ismbcspace
sprintf

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

40faca88170864c886744d1f7718d10c

Headers

File Characteristics

PDB Paths

Imports

ole32

kernel32

user32

advapi32

version

gdi32

msvcp71

msvcr71

Sections

.text Size: 60KB - Virtual size: 56KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 140KB - Virtual size: 140KB

.text
Size: 60KB - Virtual size: 56KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 140KB - Virtual size: 140KB