34045d344694b71845e73a3f64f4f372_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

34045d344694b71845e73a3f64f4f372_JaffaCakes118
Size

206KB
MD5

34045d344694b71845e73a3f64f4f372
SHA1

fbc4e37adf41db03f6ba4ff9f1129e3ce37e9e24
SHA256

7cbce64c37d90fec0869401a8d61cf11cd9ed94b85b0333da539f70b9a369141
SHA512

37ec53039c69fd50ad1460d472a3189140d3ed044b0152455e4c858a84743c084fb33e0aa6d48af0bf1f75760f1cdb3fb89e38b7db644e6ee66b2aa250065fdb
SSDEEP

3072:CGhg6R+PdCCiTC1H4BUxM16PCkIU/AxuhYhVw8J0SgctkxGxu3IQ0UO:px+PkCiKs1cCDU/UuhY3VJhUGxuIQ0U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34045d344694b71845e73a3f64f4f372_JaffaCakes118

Files

34045d344694b71845e73a3f64f4f372_JaffaCakes118
.dll windows:5 windows x86 arch:x86

673f7c625918a96dfc3010792305f39e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_wtol
wcschr
??3@YAXPAX@Z
_except_handler3
_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
_wsplitpath
wcsncmp
_wcsnicmp
_itow
_wsetlocale
__CxxFrameHandler
wcsncpy
_wmakepath
_wcsdup
wcsstr
wcstod
free
wcsrchr
_wtoi
_ftol
wcscmp
_vsnwprintf
??2@YAPAXI@Z
_wcsicmp
wcslen

user32

EnableWindow
GetDlgItem
SetWindowTextW
LoadStringW
CheckDlgButton
LoadIconW
SendMessageW
GetDesktopWindow
SendDlgItemMessageW
GetDlgItemTextW
SetFocus
MessageBoxW
GetForegroundWindow
CharPrevW
CharNextW
GetWindowLongW
SetDlgItemTextW
GetActiveWindow
SetWindowLongW
PostMessageW
IsDlgButtonChecked

kernel32

FreeLibrary
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
LockResource
IsBadWritePtr
lstrcpynW
GetLongPathNameW
LoadLibraryA
GetModuleHandleA
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetLastError
lstrcmpiW
CompareStringW
GetNumberFormatW
GetVersionExW
InterlockedDecrement
lstrlenW
GetLocaleInfoW
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
GetUserDefaultLCID
LocalAlloc
MultiByteToWideChar
GetCurrentProcessId
ProcessIdToSessionId
LocalFree
DeleteFileW
CloseHandle
GetFileType
CreateFileW
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesW

winspool.drv

SetJobW
AdvancedDocumentPropertiesW
SetPrinterW
GetPrinterW
EnumFormsW
GetJobW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
RegDeleteValueW
RegSetValueExW

ole32

OleUninitialize
OleInitialize
StringFromGUID2

shell32

SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
SHGetDesktopFolder
SHGetFolderLocation

gdi32

ExtEscape

shlwapi

StrRetToBufW
PathAddBackslashW
PathCompactPathExW
StrChrW
PathIsDirectoryW
wnsprintfA
wnsprintfW

msi

ord109
ord39

Exports

Exports

DllMain
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvPrinterEvent

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

673f7c625918a96dfc3010792305f39e

Headers

File Characteristics

Imports

msvcrt

user32

kernel32

winspool.drv

advapi32

ole32

shell32

gdi32

shlwapi

msi

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 29KB

.data Size: 172KB - Virtual size: 174KB

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 30KB - Virtual size: 29KB

.data
Size: 172KB - Virtual size: 174KB

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 2KB - Virtual size: 1KB