47dfb02023e4199d431e2b7c7efea141_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

47dfb02023e4199d431e2b7c7efea141_JaffaCakes118
Size

56KB
MD5

47dfb02023e4199d431e2b7c7efea141
SHA1

a1e3fa330549e7d61c83c1a7f630ce844e400f5e
SHA256

f4a711abbc95acf086135141158559f1d21d44afafadafcba28b5bf167a0fa94
SHA512

f64567e6921c083eeb13b5ae0a69e7290da0ccf11310acf56528c82b925759fd838327ca0843b5e4c1b66016730fcd45d061692e753d35cb4b013f5c91c02739
SSDEEP

1536:aNGopYWtZlgP+OEMFJcrJw5pLSbC94Xx1RbOfcetiDD9:aNGopYnjEWCFkaC6Xx1RbOfPtA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47dfb02023e4199d431e2b7c7efea141_JaffaCakes118

Files

47dfb02023e4199d431e2b7c7efea141_JaffaCakes118
.dll windows:5 windows x86 arch:x86

c585db6252c50e12b4329a1cb0e13982

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\jenkins\workspace\Win-DSE-1.7\source\connectors\thunderbird\ThunderbirdExtension\Release_mtd_9_0\ThunderbirdExtension_9.0.pdb

Imports

xpcom

NS_GetComponentManager
NS_CStringGetData
NS_GetServiceManager
NS_CStringContainerFinish
NS_CStringContainerInit
NS_StringContainerFinish
NS_StringContainerInit2
NS_StringContainerInit
NS_CStringSetData
NS_StringGetData

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
GetVersionExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
OutputDebugStringA
SetUnhandledExceptionFilter
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetFileAttributesExW
CreateMutexW
GetLastError
CloseHandle
GetCurrentProcessId
MapViewOfFile
EncodePointer
SetEvent
OpenEventW
GetPrivateProfileStringW
CopyFileW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
GetSystemTimeAsFileTime
InterlockedExchange
DecodePointer
OpenFileMappingW
UnmapViewOfFile

user32

DefWindowProcW
CreateWindowExW
PostMessageW
RegisterClassW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ole32

StringFromCLSID
CLSIDFromString

msvcr100

??3@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
memset
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
wcscat_s
wcsrchr
swprintf_s
?what@exception@std@@UBEPBDXZ
??_V@YAXPAX@Z
memcpy_s
??_U@YAPAXI@Z
strcpy_s
wcscpy_s
_itow_s
_waccess_s
strrchr
_purecall
_CxxThrowException
memcpy
_wsplitpath_s
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
__CxxFrameHandler3
memmove

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

Exports

Exports

NSModule

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c585db6252c50e12b4329a1cb0e13982

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

xpcom

kernel32

user32

advapi32

ole32

msvcr100

msvcp100

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB