48e1943aebfc97390ac4d5cadf02b137_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

48e1943aebfc97390ac4d5cadf02b137_JaffaCakes118
Size

467KB
MD5

48e1943aebfc97390ac4d5cadf02b137
SHA1

e70be72a4322cd8632801367bf7896ffacb59a34
SHA256

edf81e2a1f96e10c66bb01d075113d81fa5aeec3031baad394124b9064943651
SHA512

99fe8f0bf1691f35b4ab1eeb9a74420f16d7fb785346e05e688c4035b3475ab1efbfeff04e4a600f13a841de8c74eb64be4158d9b08a554ccd56b8f2272bd477
SSDEEP

12288:uUyFja3O7LhHTgDMz5rRGSSE8sFt6gFjFHVobbXDqSkLvFlM/S7ijZMTtWhAis/a:uU+ja3eBWZdeOm3tVHwE0X4uFYFqRoja

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48e1943aebfc97390ac4d5cadf02b137_JaffaCakes118

Files

48e1943aebfc97390ac4d5cadf02b137_JaffaCakes118
.dll windows:5 windows x86 arch:x86

fa4d8d2fc437d65f16796b71354f120a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\faust\rel32\faust.pdb

Imports

ole32

CoInitialize
CoCreateInstance
CoUninitialize

user32

CharPrevA
CharNextA
FindWindowA
DdeGetLastError
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeGetData
DdeFreeDataHandle
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DdeInitializeA
wsprintfA
CharLowerA
GetSystemMetrics
SetForegroundWindow
SetWindowPos
SystemParametersInfoA
EnumWindows
SendMessageTimeoutA
GetWindowLongA
SetWindowLongA
DestroyIcon

advapi32

RegDeleteKeyA
RegEnumValueA
OpenProcessToken
GetTokenInformation
RegEnumKeyExA
RegEnumKeyA
RegCloseKey
RegCreateKeyA
RegSetValueA
RegDeleteValueA
RegQueryValueA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyA
AllocateAndInitializeSid
EqualSid

shell32

ExtractIconExA
SHChangeNotify

msvcr90

getenv
printf
_chmod
rename
strncmp
_ismbblead
isdigit
isspace
iscntrl
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_stat32
_telli64
_lseeki64
_chsize
_fstat32
_errno
_vsnprintf
_ismbcspace
malloc
realloc
free
tolower
strchr
_stricmp
strpbrk
_strnicmp
strrchr
strtoul
strftime
__iob_func
fprintf
memcpy
_time32
_difftime32
strncpy
_mktime32
_localtime32
_purecall
__CxxFrameHandler3
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
atol
sprintf
strstr
??3@YAXPAX@Z
atoi
??_V@YAXPAX@Z
memset
??_U@YAPAXI@Z
??2@YAPAXI@Z
_close
_creat
_open
_sopen
_lseek
_tell
_read
_write
_unlink
_putenv
_mkdir
_rmdir
_getcwd
_chdir
memmove

msvcp90

?allocate@?$allocator@D@std@@QAEPADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z

kernel32

SetProcessWorkingSetSize
LocalFree
lstrlenA
OpenProcess
GetCurrentProcess
InitializeCriticalSection
CreateEventA
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
GetTempPathA
GetVersion
GetDiskFreeSpaceA
GetDriveTypeA
FindClose
FindNextFileA
FindFirstFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
GetSystemDirectoryA
ExpandEnvironmentStringsA
InterlockedExchange
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetTempFileNameA
SetErrorMode
ResetEvent
SetEvent
DeleteCriticalSection
WaitForSingleObject
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
WinExec
lstrcpyA
lstrcpynA
GetProfileStringA
GetEnvironmentVariableA
GetModuleFileNameA
SetEnvironmentVariableA
CopyFileA
DeleteFileA
GetTickCount
GlobalMemoryStatus
Sleep
CreateMutexA
GetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
GetVersionExA
GetPrivateProfileSectionNamesA
InterlockedDecrement
InterlockedIncrement
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle

Exports

Exports

?DdeCallback@@YGPAUHDDEDATA__@@IIPAUHCONV__@@PAUHSZ__@@1PAU1@KK@Z
EventCallback
OnInstall
OnUninstall
RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_DATA
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa4d8d2fc437d65f16796b71354f120a

Headers

File Characteristics

PDB Paths

Imports

ole32

user32

advapi32

shell32

msvcr90

msvcp90

kernel32

Exports

Exports

Sections

.text Size: 318KB - Virtual size: 317KB

.rdata Size: 49KB - Virtual size: 49KB

.data Size: 7KB - Virtual size: 12KB

_DATA Size: 512B - Virtual size: 64B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 26KB - Virtual size: 25KB

.text Size: 62KB - Virtual size: 64KB

.text
Size: 318KB - Virtual size: 317KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 7KB - Virtual size: 12KB

_DATA
Size: 512B - Virtual size: 64B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 26KB - Virtual size: 25KB

.text
Size: 62KB - Virtual size: 64KB