4699e620a1511add864792243d7b7166_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4699e620a1511add864792243d7b7166_JaffaCakes118
Size

60KB
MD5

4699e620a1511add864792243d7b7166
SHA1

018db28a527e9393d8fd3ba506e1b159a1e658d9
SHA256

70d2393fec12761eeef99cd19a0efd123b3c94e448f9b972077f369dbfc85f81
SHA512

bf4dedb3de661b5ffee815af10c00ad8a9b339a36b542ba2db7b8f889889b37e5d20569bfb4113c498af2e8dd6d3b7b23542d11c88c9a4fa8aef19f8cd9107ce
SSDEEP

768:9oayeALXe17EQJzEwOoKyuIz5EF2nMbTVpZlfUQp617TFf/jo9:maJQZQqwOoTz5EF2nGTv7c46pTpc9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4699e620a1511add864792243d7b7166_JaffaCakes118

Files

4699e620a1511add864792243d7b7166_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fd7658cf713ab753d5a904eb4777c18a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

acrx15

?copyFrom@AcRxObject@@UAE?AW4ErrorStatus@Acad@@PBV1@@Z
?comparedTo@AcRxObject@@UBE?AW4Ordering@AcRx@@PBV1@@Z
??0AcRxObject@@IAE@XZ
?isA@AcRxObject@@UBEPAVAcRxClass@@XZ
?desc@AcRxDynamicLinker@@SAPAVAcRxClass@@XZ
?clone@AcRxObject@@UBEPAV1@XZ
?isEqualTo@AcRxObject@@UBEHPBV1@@Z
acrxSysRegistry

acad.exe

?acDocManagerPtr@@YAPAVAcApDocManager@@XZ
adsw_acadMainWnd

adui15

?Create@CAdUiBaseDialog@@QAEHIPAVCWnd@@@Z
?ExchangeData@CAdUiBaseDialog@@UAEHH@Z
?OnInitDialogFinish@CAdUiDialog@@MAEXXZ
?OnInitDialogBegin@CAdUiDialog@@MAEXXZ
?OnNotifyUpdateTip@CAdUiBaseDialog@@MAE?AW4ADUI_REPLY@@PAVCWnd@@@Z
?OnNotifyGeneric@CAdUiBaseDialog@@MAE?AW4ADUI_REPLY@@IJ@Z
?OnNotifyControlValid@CAdUiBaseDialog@@MAE?AW4ADUI_REPLY@@IH@Z
?OnNotifyControlChange@CAdUiBaseDialog@@MAE?AW4ADUI_REPLY@@IJ@Z
?DoDialogHelp@CAdUiDialog@@UAEHXZ
?PreTranslateMessage@CAdUiBaseDialog@@UAEHPAUtagMSG@@@Z
?DoAdUiMessage@CAdUiBaseDialog@@MAE?AW4ADUI_REPLY@@W4ADUI_NOTIFY@@IJ@Z
?DoModal@CAdUiBaseDialog@@UAEHXZ
?PostNcDestroy@CAdUiBaseDialog@@MAEXXZ
?PreCreateWindow@CAdUiBaseDialog@@MAEHAAUtagCREATESTRUCTA@@@Z
?OnInitDialog@CAdUiBaseDialog@@MAEHXZ

acui15

?DoDataExchange@CAcUiDialog@@MAEXPAVCDataExchange@@@Z
??0CAcUiDialog@@QAE@IPAVCWnd@@PAUHINSTANCE__@@@Z
??1CAcUiDialog@@UAE@XZ
?GetRuntimeClass@CAcUiDialog@@UBEPAUCRuntimeClass@@XZ
?OnOK@CAcUiDialog@@MAEXXZ
?OnCancel@CAcUiDialog@@MAEXXZ
?FindContextHelpFullPath@CAcUiDialog@@MAEHPBDAAVCString@@@Z
?AppMainWindow@CAcUiDialog@@UAEPAVCWnd@@XZ
?AppResourceInstance@CAcUiDialog@@UAEPAUHINSTANCE__@@XZ
?AppRootKey@CAcUiDialog@@UAEPBDXZ
?InitAcUiDLL@@YAXXZ
?messageMap@CAcUiDialog@@1UAFX_MSGMAP@@B
?OnDialogHelp@CAcUiDialog@@UAEXXZ
?EnableMultiDocumentActivation@CAcUiDialog@@UAEHH@Z
?IsMultiDocumentActivationEnabled@CAcUiDialog@@UAEHXZ
?EnableFloatingWindows@CAcUiDialog@@UAEXH@Z

mfc42

ord941
ord540
ord342
ord823
ord1182
ord825
ord2864
ord4277
ord2763
ord1601
ord1099
ord2818
ord2614
ord535
ord4202
ord536
ord6662
ord4278
ord922
ord5265
ord4998
ord6052
ord4078
ord1775
ord4407
ord2385
ord5163
ord6374
ord4353
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord663
ord348
ord1105
ord5683
ord6663
ord6648
ord2379
ord940
ord859
ord926
ord858
ord2764
ord924
ord860
ord1253
ord356
ord2770
ord939
ord2915
ord5572
ord668
ord800
ord537
ord1168
ord539

msvcrt

free
atoi
malloc
__CxxFrameHandler
_mbscmp
memset
strlen
__dllonexit
_onexit
_initterm
_adjust_fdiv
_EH_prolog

kernel32

WriteFile
SetFilePointer
SetFileTime
ResumeThread
WaitForSingleObject
GetFileTime
GetDriveTypeA
GetLogicalDriveStringsA
MultiByteToWideChar
GetExitCodeThread
CreateProcessA
GetTickCount
GetModuleHandleA
lstrlenA
DeleteFileA
WinExec
GetVersionExA
SetFileAttributesA
CopyFileA
GetWindowsDirectoryA
GetSystemTime
CloseHandle
ReadFile
GetFileSize
CreateFileA
Sleep

user32

PostMessageA
EnableWindow
KillTimer
LoadStringA
SetTimer
IsWindowVisible

advapi32

RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocStringLen
VariantInit
SysFreeString
SysAllocString
VariantClear

urlmon

URLDownloadToCacheFileA

msvcp60

??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

wininet

DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA

Exports

Exports

acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd7658cf713ab753d5a904eb4777c18a

Headers

File Characteristics

Imports

acrx15

acad.exe

adui15

acui15

mfc42

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

urlmon

msvcp60

wininet

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB