303c963291736e3809389a32b1500008_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

303c963291736e3809389a32b1500008_JaffaCakes118
Size

63KB
MD5

303c963291736e3809389a32b1500008
SHA1

872aa9f705a2912d5f9df26f0ec0635ae07f0f35
SHA256

33765b51e028cd53f494287a2753c9bfbf44e5e4d2d9063f99e42df6364dac2d
SHA512

142cea88ecdfd5552629bc6e0c47ce3dd3722b638c7238dd237a07519ebec2c402382b65316ed55a68d52c9b7422d261cc8b2193cd0db3192e19a4bede5c5a70
SSDEEP

1536:WR7HEtyOw3ERKULpXBgDK6v9ctHolUQU5/ip2uOm:Q7HETuVuXBge6Fu+goG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
303c963291736e3809389a32b1500008_JaffaCakes118

Files

303c963291736e3809389a32b1500008_JaffaCakes118
.dll windows:5 windows x86 arch:x86

d27ad7697fe6a1840140ec84a2f902d5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mspmtmsg

_Poly
_FDenorm
_Wcrtomb
_Snan
_FRteps
_FDscale
_FDtest
_LPoly

user32

GetWindowLongA
TrackPopupMenu
LoadIconA
EnableScrollBar
SetScrollRange
GetClassInfoA
GetKeyboardType
CreateIcon
SetDlgItemTextA
SetCapture
SetCursor
WaitMessage
WindowFromPoint
LoadBitmapA
GetMenuStringW
MapVirtualKeyW
WinHelpA
GetClipboardFormatNameA
CopyImage
GetDCEx
GetMessagePos
DeleteMenu
RegisterWindowMessageA
IsDialogMessageA
MessageBoxA
ClipCursor
ShowCursor
GetScrollInfo
EnumChildWindows
LoadCursorA
GetSystemMenu
DestroyMenu
FillRect
CharUpperA
RedrawWindow
DefMDIChildProcA
SetMenuItemInfoW
SetCaretPos

gdi32

EndDoc
GetSystemPaletteEntries
SetRectRgn
DeleteObject
GetEnhMetaFilePaletteEntries
Pie
SetPixelV
IntersectClipRect
SetWinMetaFileBits
GetTextExtentPoint32W
GetTextAlign
CreateCompatibleBitmap
SetDIBColorTable
CreateFontIndirectA
GetBrushOrgEx
RestoreDC
CreateEnhMetaFileA
GdiFlush
CreateCompatibleDC
CreatePalette
GetMapMode

kernel32

FreeLibrary
WaitForMultipleObjects
CompareStringA
GetProcessHeap
ExitProcess
ReleaseMutex
VirtualFree
GetStartupInfoA
InitializeCriticalSection
VirtualQuery
UnmapViewOfFile
GlobalAddAtomA
FileTimeToLocalFileTime
GetCPInfo
TerminateProcess
MapViewOfFile
FindClose
GetThreadPriority
GetDateFormatA
RemoveDirectoryA
ResetEvent
CreateFileMappingW
VirtualQueryEx
CloseHandle
GetFileAttributesW
GetCurrentThread
GetComputerNameW
QueryPerformanceCounter
GetModuleHandleA
LockResource
lstrlenW

ole32

CoTaskMemAlloc
OleDraw
StringFromGUID2
ReleaseStgMedium

wininet

InternetOpenA
InternetAttemptConnect

comctl32

ImageList_SetIconSize
ImageList_Remove
ImageList_DragLeave
ImageList_GetDragImage
ImageList_GetIconSize

shell32

DragFinish
DragQueryFileA

oleaut32

SafeArrayPutElement
SafeArrayGetElement

comdlg32

GetSaveFileNameA

Exports

Exports

FreeObjectInfo
AdsTypeToLdapTypeCopyTime
CreateProcessNotify
GetDisplayName
DllClientCleanup
ChangeSeparator
faxpsec6
DllClientStartup
FindSearchTableIndex
BuildLDAPPathFromADsPath
BuildADsParentPath
AllocADsStr
ConvertU2TrusteeToSid
BuildADsParentPathFromObjectInfo
GetLDAPTypeName

Sections

.text
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d27ad7697fe6a1840140ec84a2f902d5

Headers

File Characteristics

Imports

mspmtmsg

user32

gdi32

kernel32

ole32

wininet

comctl32

shell32

oleaut32

comdlg32

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 60KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 57KB - Virtual size: 60KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB