36547b53f25958c42c8036c0a2f995d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

36547b53f25958c42c8036c0a2f995d1_JaffaCakes118
Size

276KB
MD5

36547b53f25958c42c8036c0a2f995d1
SHA1

269c7384175d05e8469028ecc59f68041add84d0
SHA256

eb75e98f238abf864a45a4bacbaf2148ba998bc0ed516cf290faa2cc57d6c651
SHA512

2b04b8b788891e20e857940a52636122c4a614046213d5d60f8d92102dac1489c73c7f6f89f1b6380cec1c0b965b2133ff7c3b92064a26eb85c65b52562b400b
SSDEEP

3072:CfFOiX2yic9Hs0QoIsCWXzyYcWY8bzy8lUDwcQMlmr52TPF3NIoc2/jo5Ag0FubJ:oOiX2hclBcWXEjE54PF3Na285AO4u1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36547b53f25958c42c8036c0a2f995d1_JaffaCakes118

Files

36547b53f25958c42c8036c0a2f995d1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

77b37b301b90562258d0d5fde1f5901e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

vstdlib

Q_snprintf
KeyValuesSystem
Q_strnicmp
Q_strncpy
RandomSeed
RandomFloat

tier0

?ExitScope@CVProfNode@@QAE_NXZ
?EnterScope@CVProfNode@@QAEXXZ
?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
Error
g_pMemAlloc
g_VProfCurrentProfile
Msg
GetCPUInformation

kernel32

CloseHandle
FlushFileBuffers
ReadFile
GetLocaleInfoW
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InitializeCriticalSection
IsBadCodePtr
IsBadWritePtr
SetUnhandledExceptionFilter
GetTickCount
IsBadReadPtr
WriteProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
VirtualProtect
Sleep
CreateThread
ExitProcess
GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
SetLastError
FlushInstructionCache
FreeLibrary
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
GetSystemInfo
VirtualAlloc
GetOEMCP
GetACP
RaiseException
GetStringTypeW
GetStringTypeA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TerminateProcess
TlsAlloc
GetLastError
TlsFree
TlsSetValue
TlsGetValue
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
InterlockedExchange
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage

user32

GetAsyncKeyState

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77b37b301b90562258d0d5fde1f5901e

Headers

File Characteristics

Imports

vstdlib

tier0

kernel32

user32

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 247KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 247KB

.reloc
Size: 20KB - Virtual size: 18KB