439b921809e0d508596ecce2a4c099e3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

439b921809e0d508596ecce2a4c099e3_JaffaCakes118
Size

64KB
MD5

439b921809e0d508596ecce2a4c099e3
SHA1

20025ba5fc83510b5809a3481c342d4679c20b27
SHA256

2f422013e5dd5136fd7d8f358a6a5fdfa49faeb53eda59674517d210b36cccd6
SHA512

d7a4270aea8cedea8f88fe3a6e2dbedcea8d6b2e68fbc10a0a12a728755d5a20f37e977abf9016d0f0481f69f1e4a389eab2d7d5649b691f4f22a13101c7282c
SSDEEP

768:Oae6FvTNqPshue0C+WUmVv9meJJd8jBi385OtPYF:OaeO50XeQ+Vlm1sPtPY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
439b921809e0d508596ecce2a4c099e3_JaffaCakes118

Files

439b921809e0d508596ecce2a4c099e3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e2c3a0262a47e68150e42993bb1a2637

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\buildbox\configurationmanagement\installers\archive\fusion\client_14.0.5\win\customactiondlls\retfoldpath\release\retFoldPath.pdb

Imports

msi

ord145
ord74
ord103
ord8
ord125
ord17

kernel32

GetEnvironmentStringsW
LCMapStringW
LCMapStringA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

Exports

Exports

retFolderPath

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2c3a0262a47e68150e42993bb1a2637

Headers

File Characteristics

PDB Paths

Imports

msi

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 4KB