31aa109e4b3f25417661a2341b84c061_JaffaCakes118

General

Target

31aa109e4b3f25417661a2341b84c061_JaffaCakes118
Size

412KB
MD5

31aa109e4b3f25417661a2341b84c061
SHA1

72bf3fc21d0f45bd3a1531039261e7e08029cc05
SHA256

daa27cd40b7493a6a0c0b150151db9f2172f3e1be0274640c8f158f26787bc23
SHA512

620b9f3db30751b05d0c5488dca84dfb2ca2d61297b5217f1d35e1382b4184be5c98b160584b1490a5094ade5dcef4a8f3fe6832b21cdd6b2a4937c9a06e3fe7
SSDEEP

12288:GVamMi1o8ZzXJZqmFyIc/KzDLBIVMusxqsa:GVamP17ZzXJsmFyIc/KnKMqsa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31aa109e4b3f25417661a2341b84c061_JaffaCakes118

Files

31aa109e4b3f25417661a2341b84c061_JaffaCakes118
.dll windows:4 windows x86 arch:x86

16fcc1625916c071f7e283c187ff7219

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Work(FB)\v20120403\BroneClient(beta02)\nvDXT\Lib\Release\nvDXT.pdb

Imports

kernel32

OutputDebugStringA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
ExitProcess
GetSystemTimeAsFileTime

user32

MessageBoxA

msvcp71

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr71

malloc
realloc
free
??3@YAXPAX@Z
sqrt
ldexp
pow
fabs
floor
ceil
exp
sin
cos
sprintf
atof
atoi
strchr
fgets
fmod
frexp
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_vsnprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
memmove
log
qsort
time
_callnewh
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
_j1
_hypot
_initterm
_adjust_fdiv
__CppXcptFilter
_except_handler3
__security_error_handler
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
__CxxFrameHandler
fclose
??_V@YAXPAX@Z
fopen

Exports

Exports

?nvDXTcompress_wrap@@YAXPAEKKKPAVnvCompressionOptions@@W4nvPixelOrder@@P6A?AW4NV_ERROR_CODE@@PBXIPBUMIPMapData@@PAX@Z@Z

Sections

.text
Size: 360KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16fcc1625916c071f7e283c187ff7219

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 358KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 24KB - Virtual size: 56KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 360KB - Virtual size: 358KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 24KB - Virtual size: 56KB

.reloc
Size: 12KB - Virtual size: 10KB