0f0addfce26ac8d9b2a3128c685627dd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0f0addfce26ac8d9b2a3128c685627dd_JaffaCakes118
Size

244KB
MD5

0f0addfce26ac8d9b2a3128c685627dd
SHA1

56504b77dc6177529712798638b7820187c7ef11
SHA256

01b84f93f5e544eb931d8c96b954eaf4aeec86bf033c770b7d04806f18ec9b0f
SHA512

b20e02c4c89e554ff35ededc19342fedf4bfab3a5c2674c92b9af34c0f0416cbf27d3bb1fcd1fb61adf3d40bef0ba3b26d1131805a2587324ad1dff5757baa4b
SSDEEP

6144:q7SKZGE8Y+po2slbmDgYtzO/9k5DMgpY02rZU+G9FpyLqAFMv9hm:dyirCbmxCW5Id0oZURymD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f0addfce26ac8d9b2a3128c685627dd_JaffaCakes118

Files

0f0addfce26ac8d9b2a3128c685627dd_JaffaCakes118
.dll windows:5 windows x86 arch:x86

b326dcd45129459fe37dcf934c830dcd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

compdll.pdb

Imports

msvcr71

_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__CppXcptFilter
_adjust_fdiv
_initterm
wcsrchr
wcscmp
swprintf
wcscpy
wcscat
wcschr
sprintf
_wsplitpath
_tempnam
memmove
remove
_lseek
_close
_write
_read
_open
_errno
malloc
realloc
__CxxFrameHandler
free
_except_handler3
_CxxThrowException
memset

kernel32

GetVersionExA
SetLastError
GetModuleHandleA
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DosDateTimeToFileTime
LocalFileTimeToFileTime
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetLastError
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
SizeofResource
LoadResource
CloseHandle
CompareFileTime
GetFileTime
SystemTimeToFileTime
GetSystemTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileInformationByHandle
lstrlenA
FindClose
SetFileTime

user32

UpdateWindow
IsWindow
GetParent
GetLastActivePopup

advapi32

RegCloseKey

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW

cabinet

ord22
ord20
ord21
ord23

utlsrf06

StringCopyW
PvHEAPAllocate_
HEAPFree
MakePathW
StringCopyA

adapt

??0CMszHinst@@QAA@PAUHINSTANCE__@@KPBG1ZZ
??1CAutoSzHinst@@QAE@XZ
??1CMszHinst@@QAE@XZ
??0CMszHinst@@QAE@PAUHINSTANCE__@@KPBG@Z
?szNullASZ@@3PAGA

Exports

Exports

CompressFile
FDIEDecompressFile
IsCabinetFile

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b326dcd45129459fe37dcf934c830dcd

Headers

File Characteristics

PDB Paths

Imports

msvcr71

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

cabinet

utlsrf06

adapt

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 49KB

.data Size: 172KB - Virtual size: 176KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 49KB - Virtual size: 49KB

.data
Size: 172KB - Virtual size: 176KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 4KB - Virtual size: 3KB