1674cf64b9c8ed10eb967a91fdb16f3b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1674cf64b9c8ed10eb967a91fdb16f3b_JaffaCakes118
Size

19KB
MD5

1674cf64b9c8ed10eb967a91fdb16f3b
SHA1

98b4efd3493f383fca3216c08bab1f78bcc5468a
SHA256

c7423db0f089eed635e5a67ecf8ce9d1550fb72aa2dd3e1732a4cd2b27c598ad
SHA512

4a75122fea43b3a3b548eea19d780e65c9df76c775ce14fae22212284c713a4c3e90ffad93a2bee0abf7199a5c754f7be241d5195d167da7def4f4d6d9eb3078
SSDEEP

384:KE2nLRZno07YTTzdfU8u4Zmusid1lcwKBwl6V5zbi+:+RZno07YTBU8LmQsqgRbi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1674cf64b9c8ed10eb967a91fdb16f3b_JaffaCakes118

Files

1674cf64b9c8ed10eb967a91fdb16f3b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

171d007ff8cbe8c35682ad847c5f071a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\products\FreeSamples\Release\FreeSamples.pdb

Imports

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
DisableThreadLibraryCalls
SetCurrentDirectoryA
SetThreadPriority
CreateProcessA
CloseHandle
GetModuleHandleA
GetTickCount
Sleep

user32

MoveWindow
EndDialog
LoadStringA
GetDlgItem
EnableWindow
SendMessageA
SetWindowTextA
SetWindowRgn
LoadImageA

gdi32

DeleteObject
CreateFontA

shell32

ShellExecuteA

network

?gf_Network_ConnectToWebType@@YA_NPADH@Z

windows

?BitmapToRegion@CDialog@@IAEPAUHRGN__@@PAUHBITMAP__@@KK@Z
?DoDialog@CDialog@@QAEHHPAUHWND__@@@Z

windowsex

??1CDialogEx@@UAE@XZ
?SetFont@CDialogEx@@QAEXPAUHFONT__@@@Z
??0CDialogEx@@QAE@PAUHINSTANCE__@@@Z
?GetItemEx@CDialogEx@@QAEPAVCWindowEx@@H@Z
?sc_BaseHandler@CDialogEx@@CGHPAUHWND__@@IIJ@Z

bpk

??0CBitmap@@QAE@XZ
?Read@CBitmap@@QAEPAUHBITMAP__@@PAD@Z
??1CBitmap@@QAE@XZ

system

?Get@CRegistry@@QAEXPAD00@Z
??0CRegistry@@QAE@PAD0PAUHKEY__@@@Z
?Set@CRegistry@@QAEXPADH@Z
?Terminate@CThread@@QAEHH@Z
?Begin@CThread@@QAEHP6GKPAX@Z0@Z
??0TDATE@@QAE@HHH@Z
?ToString@TDATE@@QAEPADPAD@Z
??0CThread@@QAE@XZ
??1CThread@@UAE@XZ
?MiniLog@CApplication@@QAEXPAD0@Z
?Set@CRegistry@@QAEXPAD0@Z
?DeleteIt@CFile@@MAEHPAD@Z
?FindClose@CFile@@MAEXPAX@Z
?FindNextFileA@CFile@@MAEHPAXPAU_WIN32_FIND_DATAA@@@Z
?FindFirstFileA@CFile@@MAEPAXPADPAU_WIN32_FIND_DATAA@@@Z
?Progress@CFile@@MAEHJ@Z
??0CFile@@QAE@XZ
??1CFile@@UAE@XZ
?GetCount@CFileGroup@@UAEHPAD@Z
?WriteIt@CFileGroup@@MAEHPAXJPAJ@Z
?ReadIt@CFileGroup@@MAEHPAXJPAJ@Z
?CloseIt@CFileGroup@@MAEXXZ
?OpenIt@CFileGroup@@MAEPAXPADHH@Z
?Truncate@CFileGroup@@UAEHXZ
?Seek@CFileGroup@@UAEJJH@Z
?EndSearch@CFile@@QAEXXZ
?BeginSearch@CFile@@QAEHPAD0@Z
?Close@CFile@@QAEXXZ
?Read@CFile@@QAEPAXPAJ@Z
?Open@CFile@@QAEHPADHH@Z
?s_Application@CApplication@@2PAV1@A
?Get@CRegistry@@QAEXPADPAHH@Z
?IsItRegistered@CApplication@@QAEHXZ
??0TDATE@@QAE@H@Z
?Mem_Free@@YAXPAX@Z
?Mem_ReleaseAlloc@@YAPAXI@Z
?CreateIt@CFile@@MAEHPAD@Z
?RemoveIt@CFile@@MAEHPAD@Z

msvcr70

atoi
time
__CxxFrameHandler
_except_handler3
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
?terminate@@YAXXZ
strtok
__security_error_handler
srand
rand
difftime
tolower
strstr
sprintf

Exports

Exports

??0CFreeSamples@@QAE@HHH@Z
??1CFreeSamples@@UAE@XZ
?Disable@CFreeSamples@@QAEXXZ
?Display@CFreeSamples@@QAE_NPAUHWND__@@_N@Z
?Enable@CFreeSamples@@QAEXXZ
?OpenFreeSamples@CFreeSamples@@QAEXXZ
?sc_Init@CFreeSamples@@SAHXZ
?sc_UnInit@CFreeSamples@@SAXXZ

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

171d007ff8cbe8c35682ad847c5f071a

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

network

windows

windowsex

bpk

system

msvcr70

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 192B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 192B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB