3c7d1313519228db9b37d2c6781420aa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3c7d1313519228db9b37d2c6781420aa_JaffaCakes118
Size

252KB
MD5

3c7d1313519228db9b37d2c6781420aa
SHA1

f6fd34eb28748ec17c116a9c9bf54fa890db30a5
SHA256

87f7a0ac8a07f34cfc0dc3ac4a7aa8ffb0cbc9fe8e66405d61840ca26b853280
SHA512

053e5294f9922cdee3098cfe879128d63ffece80636d1884c8e49f3e9fdea3c43a0c39f02edc31ff976ead55bc20051a670aaa012cb39662ddf31d915c188b17
SSDEEP

6144:5yqHMl90NyjtgOg0XiX1KM7ScPnUl8B0VPX:4qG0Ijr2PnUlb/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c7d1313519228db9b37d2c6781420aa_JaffaCakes118

Files

3c7d1313519228db9b37d2c6781420aa_JaffaCakes118
.dll windows:4 windows x86 arch:x86

87a06a117a600e8b306911078b593f6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Work\Projects\Centrale Standard\ZenCentral\MediaSniffer_Engine\Src\MediaSniffer\release\pcmlUpdt.pdb

Imports

ctintrfu

?CTCreateInstance@@YG?AW4tagCTINTRFCRESULT@@ABU_GUID@@PAUIUnknown@@K0PAPAX@Z
?CTFreeUnusedLibraries@@YGXXZ
?CTCreateInstance@@YG?AW4tagCTINTRFCRESULT@@ABU_GUID@@PAUIUnknown@@K0PAPAXPBG@Z

gdiplus

GdipCreateHBITMAPFromBitmap
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipCreateBitmapFromStream
GdipGetImageEncodersSize
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipFree
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipAlloc

kernel32

TerminateProcess
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CreateFileW
GetFileSizeEx
CloseHandle
GetFileTime
GetLastError
Sleep
GetModuleFileNameW
lstrlenW
SizeofResource
LockResource
LoadResource
FindResourceExW
SetUnhandledExceptionFilter
GetACP
FindResourceW
CompareFileTime
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
FreeLibrary
lstrlenA
MultiByteToWideChar
lstrcpynW
InitializeCriticalSection
DeleteCriticalSection
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ReadFile
EnterCriticalSection
LeaveCriticalSection
GetFileSize
CreateMutexW
OpenMutexW
WaitForSingleObject
ReleaseMutex
lstrcmpiW
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
lstrcpyW
RaiseException
GetVersionExA

gdi32

DeleteObject

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

SafeArrayCreate
SafeArrayUnaccessData
VariantClear
SysAllocString
SysFreeString
VariantInit
VariantTimeToSystemTime
VariantChangeType
SafeArrayGetUBound
SafeArrayAccessData

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
PathAppendW
StrToIntExW
PathFindExtensionW
PathRemoveExtensionW
PathRemoveBackslashW
StrStrIW
PathFileExistsW
StrToInt64ExW

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_malloc_crt
memset
_CIpow
wcsstr
_wtoi
_wtoi64
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
memcpy
__CxxFrameHandler3
_CxxThrowException
??3@YAXPAX@Z
memcpy_s
memmove_s
free
_invalid_parameter_noinfo
malloc
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
?what@exception@std@@UBEPBDXZ
_wcslwr_s
_localtime64_s
_time64
_vscwprintf
vswprintf_s
??_V@YAXPAX@Z
iswspace
_wmakepath
_wsplitpath
_swprintf
ceil
_vswprintf
calloc

user32

UnregisterClassA

Exports

Exports

CreateFolderTable
CreatePcmlObj
DeleteFolderTable
GetMusicExt
GetMusicInfo
GetPhotoExt
GetPhotoInfo
GetVideoExt
GetVideoInfo
InitPcml
IsMediaFileType
IsMusicFileType
IsPictureFileType
IsVideoFileType
UninitPcml
init_get_media_info
uninit_get_media_info

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

87a06a117a600e8b306911078b593f6c

Headers

File Characteristics

PDB Paths

Imports

ctintrfu

gdiplus

kernel32

gdi32

advapi32

ole32

oleaut32

shlwapi

msvcp80

msvcr80

user32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text Size: 100KB - Virtual size: 100KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 100KB