4567460fe37b3e49e5a437d92b612759_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4567460fe37b3e49e5a437d92b612759_JaffaCakes118
Size

110KB
MD5

4567460fe37b3e49e5a437d92b612759
SHA1

7a79c09c82bf57e216157bd4062e3ef0caaa18d0
SHA256

f66bed543f7f050edab3ffb84e1ab0c97ffabe3b5b474d7ca06d61203f6042ef
SHA512

ebe9730b3e84f5dad6f06fdf0d238914a67d4d31b0294b5bd8c912237e483b3d18a294986d53ecbee6bf5086a36359bb9583b974fd4bc4779e4c627edcc75832
SSDEEP

3072:NtmC1m7Bs5dL+yw7CWWwXh/DGc66k9AiNmRR:NtmCIA4CWWwXh/D46k96R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4567460fe37b3e49e5a437d92b612759_JaffaCakes118

Files

4567460fe37b3e49e5a437d92b612759_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e745aa63636712bf121e8b9b1f86333a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\cygwin\home\kovid\sw\build\ImageMagick-6.5.6\VisualMagick\bin\IM_MOD_RL_uyvy_.pdb

Imports

core_rl_magick_

FormatMagickString
DestroyImageList
GetFirstImageInList
CloseBlob
EOFBlob
LoadImageTag
SyncAuthenticPixels
QueueAuthenticPixels
ThrowMagickException
ReadBlobByte
OpenBlob
CopyMagickString
AcquireImage
LogMagickEvent
UnregisterMagickInfo
DestroyImage
GetVirtualPixels
WriteBlobByte
ResetMagickMemory
TransformImageColorspace
CloneImage
RegisterMagickInfo
ConstantString
SetMagickInfo

msvcr90

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_malloc_crt
_encode_pointer
_errno
strerror
_encoded_null

kernel32

LoadLibraryA
GetProcAddress
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

RegisterUYVYImage
UnregisterUYVYImage

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e745aa63636712bf121e8b9b1f86333a

Headers

File Characteristics

PDB Paths

Imports

core_rl_magick_

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 872B

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 1024B - Virtual size: 552B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 872B

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 1024B - Virtual size: 552B