1b143791f8c958edab22d9268270b859_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1b143791f8c958edab22d9268270b859_JaffaCakes118
Size

188KB
MD5

1b143791f8c958edab22d9268270b859
SHA1

4755ecc37f22f6c036c55a4f92b2f34d17644a6f
SHA256

91ba5776a63f0eb6956545a23ba3d61c8a6bcd0b9309fabd7068de3089192b04
SHA512

cb0f3132e3428924f39beb70136e07565ce4c2fe4fc394ea824ea82186931eb4abdc6da1afd0e9ee5f03fd713400c2facaf9b57838aedcf41adcde81ffe4a4da
SSDEEP

3072:JS5iNpdtU5VRAeX7ELQ2i8NDF85k4A6hkXx4DnpdyILkWvwU05Ug/uEqh:JSj5VRAeILlid5k4lk2Dpdyevw759gh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b143791f8c958edab22d9268270b859_JaffaCakes118

Files

1b143791f8c958edab22d9268270b859_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9b2dc50918ac69ac9c2ee5382edc01ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFindFileNameW
PathRemoveFileSpecA
PathAppendA
PathRemoveFileSpecW
PathAppendW
PathIsURLW
StrChrW

kernel32

DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
CreateThread
lstrlenW
WideCharToMultiByte
FindClose
FindNextFileW
FindFirstFileW
lstrcpyW
MultiByteToWideChar
lstrcpynW
DeleteFileW
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
WritePrivateProfileStringA
GetPrivateProfileIntA
WaitForSingleObject
MulDiv
CloseHandle
ResumeThread
SetThreadPriority
GetModuleFileNameA

user32

SendMessageW
GetWindowLongA
SetDlgItemTextW
SetWindowLongA
ShowWindow
DestroyWindow
MessageBoxA
PostMessageA
EndDialog
CheckDlgButton
IsDlgButtonChecked
GetDlgItem
EnableWindow
SendMessageA

gdi32

DeleteObject

nscrt

??3@YAXPAX@Z
_purecall
_wcsdup
_vsnprintf
??_V@YAXPAX@Z
_strdup
_stricmp
??_U@YAPAXI@Z
__CppXcptFilter
strchr
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
_except_handler3
?terminate@@YAXXZ
_CIpow
??2@YAPAXI@Z
_vsnwprintf
__CxxFrameHandler
wcscmp
free
wcslen

Exports

Exports

winampGetMediaLibraryPlugin
winampUninstallPlugin

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b2dc50918ac69ac9c2ee5382edc01ed

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

nscrt

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 316B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 316B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB