171d68aeda2713c76afcd1c23557f197_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

171d68aeda2713c76afcd1c23557f197_JaffaCakes118
Size

56KB
MD5

171d68aeda2713c76afcd1c23557f197
SHA1

434acbfb85a6e2d8c973b98c266b095133b940c5
SHA256

68c00dad38be808e139c69ed4bb08921e087d54036798730957788c01a2c91e5
SHA512

2bb761dbd8fb71da6374a2b8edcad4cbc7f360e610c3dce2b7eba15d3fceec6cca7c1a197abbf08f0f4aecc9cad48390ea09c519ce1a86edc3b97cc163d8bc57
SSDEEP

1536:yz9KdfKg6+I73rmCeniT/xSAEn9MOKd7unXCjIZBF:k9KdfKg6+A3rjeniLcAEnmOKdKnX9ZB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
171d68aeda2713c76afcd1c23557f197_JaffaCakes118

Files

171d68aeda2713c76afcd1c23557f197_JaffaCakes118
.dll windows:5 windows x86 arch:x86

78a187ee6d153125dc5719a6c01dac81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathCombineW
PathAppendW

kernel32

WideCharToMultiByte
MultiByteToWideChar
SetCurrentDirectoryW
GlobalAlloc
GetCurrentDirectoryW
CloseHandle
ReadFile
CreateFileW
GetFileAttributesW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentProcessId
DisableThreadLibraryCalls
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceCounter
IsDebuggerPresent
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetStringTypeExW
OutputDebugStringW
Sleep
GetTickCount
GetCurrentThreadId
CompareStringW

user32

InsertMenuItemW
GetSubMenu
CallWindowProcW
SetWindowLongW
ShowWindow
UpdateWindow
SetDlgItemTextW
DestroyWindow
SetWindowTextW
GetDlgItem
SendMessageW
SendDlgItemMessageW
GetParent
CheckDlgButton
GetMenuItemInfoW
wsprintfA
IsCharAlphaW
EndDialog

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

SHGetSpecialFolderPathW

msvcr90

_wcsicmp
wcslen
_wtoi64
??2@YAPAXI@Z
_wcsnicmp
_wcsdup
_vsnwprintf
memcpy
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_wcstoui64
realloc
strlen
malloc
_mkgmtime64
_wtof_l
_create_locale
_wtoi
wcsncpy
vsprintf_s
iswxdigit
wcstok
strncpy
free
fwrite
fclose
fflush
_wfopen
memmove
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
wcsftime
_gmtime64
_i64tow
__CxxFrameHandler3
??3@YAXPAX@Z
_purecall
memset

Exports

Exports

winampGetMediaLibraryPlugin

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78a187ee6d153125dc5719a6c01dac81

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

comdlg32

shell32

msvcr90

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB