3d1a44c6c65df94fe2b4bc8814478bfa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d1a44c6c65df94fe2b4bc8814478bfa_JaffaCakes118
Size

915KB
MD5

3d1a44c6c65df94fe2b4bc8814478bfa
SHA1

ec66933bc6fffedf16637c15f39fd41c5c059abc
SHA256

1fff2a2b4d5cf5aaf5046f10e27392ec92782982df8c7db97bda02a0068b40b1
SHA512

101f6d6a086a0d019c822c463c66fcda44aefc0fdb94747760e195623db7bd6047dc6288992047b1e9303739bb5a3a7d639b8b624e2a165e3af014fae8d2f8e2
SSDEEP

12288:5saDxRv9OjVrhWrTMHU9S/gbjD9jSg1cElgbo3GNkxkCyEAdMbsRMN/AEYuJ4AWn:5s+ErWMHU9DhtCWg2xAEdNUfJTq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d1a44c6c65df94fe2b4bc8814478bfa_JaffaCakes118

Files

3d1a44c6c65df94fe2b4bc8814478bfa_JaffaCakes118
.dll windows:5 windows x86 arch:x86

245d68724fde03d53fac70f646e777ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\maxima\Documents\Visual Studio 2008\Projects\lsp\nonifslsp\Debug\lsp.pdb

Imports

ws2_32

WSACleanup
WSASetLastError
WSCGetProviderPath
WSAGetLastError
WSAStartup
WSCInstallProvider
htons
send
ioctlsocket
connect
gethostbyname
closesocket
getsockopt
recv
select
WSCEnumProtocols
WPUCompleteOverlappedRequest
WSCDeinstallProvider
WSCWriteProviderOrder

rpcrt4

UuidCreate

ole32

StringFromGUID2

msi

ord67
ord44
ord180

kernel32

SetEndOfFile
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
InterlockedExchange
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetConsoleMode
GetConsoleCP
VirtualQuery
GetProcessHeap
LCMapStringW
CloseHandle
GetLastError
GetExitCodeThread
WaitForSingleObject
LeaveCriticalSection
CreateThread
CreateEventA
EnterCriticalSection
ExitThread
SetEvent
GetCurrentProcessId
ResetEvent
InterlockedIncrement
DebugBreak
GetVersionExA
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
GetSystemDirectoryA
CreateSemaphoreA
GetSystemInfo
CreateIoCompletionPort
WaitForMultipleObjectsEx
PostQueuedCompletionStatus
ReleaseSemaphore
WaitForSingleObjectEx
GetQueuedCompletionStatus
lstrcpyW
OutputDebugStringA
HeapAlloc
HeapFree
CompareStringA
HeapDestroy
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
ExpandEnvironmentStringsW
InterlockedDecrement
DeleteCriticalSection
TlsFree
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
ReleaseMutex
GetModuleFileNameA
GetCurrentThreadId
WaitForMultipleObjects
CreateMutexA
GetModuleHandleA
ResumeThread
LocalFree
FormatMessageA
GlobalMemoryStatusEx
GetDriveTypeA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetUserGeoID
GetOEMCP
GetThreadLocale
GetLocaleInfoA
GetNativeSystemInfo
IsWow64Process
GetTempPathA
SetEnvironmentVariableA
GetCurrentDirectoryA
GetCurrentProcess
SetLastError
WriteFile
CreateFileA
LoadLibraryExA
SystemTimeToFileTime
GetSystemTime
LCMapStringA
SetFilePointer
ReadFile
SetConsoleCtrlHandler
GetTickCount
QueryPerformanceCounter
VirtualFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentThread
IsValidCodePage
GetCPInfo
GetACP
FatalAppExitA
CompareStringW
HeapCreate
GetFullPathNameA
ExitProcess
GetModuleHandleW
IsBadReadPtr
GetSystemTimeAsFileTime
RtlUnwind
GetCommandLineA
GetModuleFileNameW
WriteConsoleW
GetFileType
GetStdHandle
IsDebuggerPresent
RaiseException
lstrlenA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetHandleCount
GetStartupInfoA
HeapValidate

user32

LoadStringA
IsWindow
wvsprintfA
wsprintfA
PostQuitMessage
DefWindowProcA
RegisterClassA
CreateWindowExA
GetSystemMetrics
TranslateMessage
DispatchMessageA
DestroyWindow
UnregisterClassA
PostMessageA
GetMessageA

advapi32

GetTokenInformation
OpenProcessToken

shell32

SHGetFolderPathA
ord680

Exports

Exports

GetLspGuid
WSPStartup

Sections

.textbss
Size: - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 734KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

245d68724fde03d53fac70f646e777ca

Headers

File Characteristics

PDB Paths

Imports

ws2_32

rpcrt4

ole32

msi

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.textbss Size: - Virtual size: 353KB

.text Size: 734KB - Virtual size: 733KB

.rdata Size: 133KB - Virtual size: 133KB

.data Size: 7KB - Virtual size: 17KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 29KB - Virtual size: 28KB

.textbss
Size: - Virtual size: 353KB

.text
Size: 734KB - Virtual size: 733KB

.rdata
Size: 133KB - Virtual size: 133KB

.data
Size: 7KB - Virtual size: 17KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 29KB - Virtual size: 28KB