1a02641a2e15f597b7123a34f03c9ef4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1a02641a2e15f597b7123a34f03c9ef4_JaffaCakes118
Size

115KB
MD5

1a02641a2e15f597b7123a34f03c9ef4
SHA1

3db9bfe326734195b1c4e04fd41e9b0bf83a3ba1
SHA256

6b66aa254ff681f079ca04ef68bd8cd9b205bdc306174f4dc5aaafcf8171f1af
SHA512

a9d20c6e872518e69756cd66189c7e08afe62046583999d140a2c5bf2690d2a6658107deb3da116030be371e359a3060dfae41d08f01e03c07a8045f8c8ea6af
SSDEEP

3072:Lu+3mrzDWeIEqf/Ej4oEcl9aFYIYEQXoRP+OtRKXAbTYIqFO7a:iBDWeInX1o1CQ++Ot0L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a02641a2e15f597b7123a34f03c9ef4_JaffaCakes118

Files

1a02641a2e15f597b7123a34f03c9ef4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e2ffdceeedfc56d5954db63dbf9e997f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comctl32

ImageList_Add
ImageList_Replace
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
ord17

shlwapi

PathAppendW
PathFindNextComponentW
PathFileExistsW
StrFormatByteSizeW
PathCombineW

kernel32

InitializeCriticalSection
DeleteCriticalSection
lstrcpynW
MulDiv
CompareStringW
InterlockedIncrement
InterlockedDecrement
lstrlenW
SetEvent
GlobalAddAtomW
TlsAlloc
GetModuleHandleW
GetCurrentThread
GlobalDeleteAtom
SleepEx
QueueUserAPC
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
CreateWaitableTimerW
CloseHandle
SetWaitableTimer
SetLastError
GetLastError
CreateDirectoryW
SetErrorMode
GetDateFormatW
GetTimeFormatW
WaitForSingleObject
CreateEventW
DeleteFileW
GetPrivateProfileIntW
FileTimeToSystemTime
FindClose
FindFirstFileW
ReadFile
CreateFileW
Sleep
WriteFile
CreateThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
InterlockedExchange
LeaveCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
IsDebuggerPresent

user32

SetWindowLongW
RedrawWindow
BeginDeferWindowPos
PostMessageW
MapWindowPoints
EndDeferWindowPos
GetDlgItem
GetWindowRect
GetWindowLongW
SetRectEmpty
DeferWindowPos
EnableMenuItem
DestroyWindow
ShowWindow
DeleteMenu
GetClassNameW
GetWindowTextW
GetFocus
GetParent
GetCursorPos
PtInRect
CopyRect
KillTimer
GetClientRect
GetCapture
ReleaseCapture
GetAsyncKeyState
SetCapture
LoadAcceleratorsW
SetTimer
ClientToScreen
ScreenToClient
GetMenuItemID
GetWindowTextLengthW
GetDlgItemTextW
SetPropW
EnableWindow
EndDialog
RemovePropW
GetPropW
SetWindowPos
CheckRadioButton
SendDlgItemMessageW
CharPrevW
SetWindowTextW
IsDlgButtonChecked
SetDlgItemTextW
CheckDlgButton
MessageBoxW
CopyAcceleratorTableW
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
MapVirtualKeyW
GetKeyNameTextW
CharNextW
GetSubMenu
DestroyMenu
LoadCursorW
InvalidateRect
SendMessageW
GetUpdateRgn

gdi32

CreateRectRgnIndirect
GetObjectW
SetRectRgn
CreateRectRgn
CombineRgn
OffsetRgn
DeleteObject

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW

oleaut32

SysAllocStringLen
SysFreeString
VariantInit

nde

NDE_Table_AddIndexByID
NDE_Table_PostColumns
NDE_Table_NewColumn
NDE_StringField_SetString
NDE_Scanner_NewFieldByID
NDE_IntegerField_SetValue
NDE_Scanner_LocateString
NDE_Table_CreateScanner
NDE_Scanner_New
NDE_Scanner_Post
NDE_Table_DestroyScanner
NDE_Table_Sync
NDE_Database_OpenTable
NDE_Database_CloseTable
NDE_DestroyDatabase
NDE_CreateDatabase

msvcr90

_adjust_fdiv
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
wcscpy_s
_fwprintf_l
_wfopen
fwrite
fclose
fwprintf
fputws
fputwc
wcscat
wcscpy
_wtof_l
memmove_s
wcschr
__timezone
_mktime64
_gmtime64
iswdigit
wcsncmp
iswspace
_wtoi
memcpy
wcslen
iswxdigit
_wcsicmp
realloc
tolower
malloc
_i64tow
_vsnprintf
_tzset
__CppXcptFilter
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_amsg_exit
_wcsnicmp
_crt_debugger_hook
_localtime64
_wtoi64
_purecall
??2@YAPAXI@Z
memcmp
??_U@YAPAXI@Z
_vsnwprintf
??_V@YAXPAX@Z
??3@YAXPAX@Z
_wcsdup
free
memset
__CxxFrameHandler3
wcscmp
_time64

Exports

Exports

winampGetMediaLibraryPlugin

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2ffdceeedfc56d5954db63dbf9e997f

Headers

File Characteristics

Imports

comctl32

shlwapi

kernel32

user32

gdi32

shell32

oleaut32

nde

msvcr90

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 7KB