49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118
Size

227KB
MD5

49a4264ca9612c3ee3f10bfbef13eeea
SHA1

5b1f7f1850ebb364d1fbeba2208a323f76db6a13
SHA256

08e75249facc89310e17d371de21f691977677546136ce0ce7ae13ff65524e6e
SHA512

08662f23127e5520840e37c6479f3801ed886e0d217ab71812217c1d4e7ce257d2c047c13488e6f65eb8041e21919f325affee08c62ed1b90788ed7031aed5e1
SSDEEP

6144:dz6ZaxnqgOe4L4Ah9jQk7O4YXuueW/t+XG3I3:dWOqgOeoffFY+u7/tr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118

Files

49a4264ca9612c3ee3f10bfbef13eeea_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3a19f906be794bf4d9d371863a7a6a0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\mtgenbvpGdhta\ALmdfcghZLvek\AragKnptai.pdb

Imports

gdi32

ExtTextOutA
GetNearestColor
SetDIBits
GetWindowOrgEx
AddFontResourceW
OffsetRgn
ScaleWindowExtEx
UnrealizeObject
CreateDIBitmap
CreateFontIndirectA
CreateFontW
GetTextCharsetInfo
SetLayout
CreateRoundRectRgn
GetTextMetricsA
SetWindowOrgEx
GetTextAlign
RestoreDC
RemoveFontResourceW
DeleteObject
Ellipse
IntersectClipRect
WidenPath
PatBlt
SetPaletteEntries
ScaleViewportExtEx
Escape
CreatePolygonRgn
GetFontData
PathToRegion
ExtTextOutW
CreatePalette
GetPaletteEntries
RoundRect
GetViewportOrgEx
SetBitmapDimensionEx
EndPath
RectVisible
SetAbortProc
GetTextExtentPoint32A
SetWindowExtEx
CreateBitmap
Polyline
CreatePenIndirect

comctl32

ImageList_Remove
CreatePropertySheetPageA
CreateStatusWindowW
ImageList_Destroy
PropertySheetA
ImageList_Write

user32

HideCaret
RemovePropW
GetDC
IsCharLowerA
CopyRect
ExitWindowsEx
GetWindowTextW
DefFrameProcW
MonitorFromRect
GetWindowPlacement
GetWindowDC
SwitchToThisWindow
GetMenuCheckMarkDimensions
GetShellWindow
CharLowerA
SetCursorPos
DestroyMenu
EqualRect
PostThreadMessageW
GetDlgItemTextW
WindowFromPoint
GetDlgCtrlID
GetClassLongW
GetTopWindow
CharPrevW
LoadIconA
VkKeyScanW
SetWindowRgn
CopyAcceleratorTableW
TabbedTextOutW
IsDialogMessageW
ChildWindowFromPoint
CharUpperBuffA
SetWindowTextW
LoadAcceleratorsA
CreateWindowExW
DialogBoxParamW
FillRect
ModifyMenuW
GetDlgItemTextA
DrawIconEx
MapVirtualKeyW
ScreenToClient
OpenDesktopW
IsWindowEnabled
SetMenuDefaultItem
IsWindowUnicode
GetSubMenu
SendDlgItemMessageA
MessageBoxExW
DialogBoxIndirectParamA
CharLowerW
SendDlgItemMessageW
IsRectEmpty
GetMenuItemID
CharToOemA
DestroyWindow
GetSysColor
MoveWindow
wvsprintfW
OpenIcon
GetIconInfo
SetWindowPlacement
GetMessageA
GetMessageW
PtInRect
GetMenuItemCount
TranslateMessage
PostThreadMessageA
GetWindowTextA
GetClassInfoA
CreateDialogParamA
CreateCaret
GetSysColorBrush
MapVirtualKeyA
GetMenuItemRect
PeekMessageA
SetLastErrorEx
UpdateWindow
GetParent
FindWindowExA
GetCursorPos
InternalGetWindowText
GetSystemMenu
DialogBoxIndirectParamW
SetTimer
GetKeyState
OemToCharA
EndPaint
LoadMenuA
GetNextDlgGroupItem
GetKeyboardLayoutList
CharNextW
GetUserObjectInformationW
SetScrollRange
WaitMessage
SystemParametersInfoA
SetPropW
GrayStringW
GetLastActivePopup
OpenInputDesktop
IsCharUpperA
SendMessageA
GetDCEx
GetScrollPos
RegisterWindowMessageA
LookupIconIdFromDirectory
DrawEdge
SetScrollPos

msvcrt

iswalpha
strstr
strpbrk
tolower
malloc
wcsncpy
sscanf
_controlfp
__set_app_type
vsprintf
floor
__p__fmode
fprintf
vswprintf
toupper
fseek
islower
__p__commode
getc
strspn
_amsg_exit
wcstoul
_initterm
iswspace
_acmdln
ftell
exit
_ismbblead
strtol
_XcptFilter
wcstombs
wcscmp
isalnum
_exit
clock
_cexit
mbstowcs
__setusermatherr
strncpy
wcspbrk
__getmainargs
fread
fputs
isprint
wcsncmp
realloc

comdlg32

ChooseColorW
GetSaveFileNameW
PageSetupDlgW
ChooseFontW
FindTextW
CommDlgExtendedError

kernel32

GetCurrentThreadId
SetMailslotInfo
CompareStringW
CreateFileMappingA
SetNamedPipeHandleState
TerminateThread
CreateRemoteThread
ClearCommBreak
SetHandleCount
GetWindowsDirectoryW
CreateSemaphoreA
FindResourceW
IsValidLanguageGroup
LCMapStringA
lstrcmpA
SetCommTimeouts
GlobalLock
GetSystemTimeAdjustment
GetWindowsDirectoryA
CompareStringA
PulseEvent
DisconnectNamedPipe
CloseHandle
WideCharToMultiByte
FindFirstFileA
GetOEMCP
GetStartupInfoW
SuspendThread
LoadLibraryExA
SetEndOfFile
CreateEventA
LocalLock
GetCompressedFileSizeW
GetHandleInformation
GetExitCodeProcess
OpenFileMappingA
lstrcmpiW
GetUserDefaultLCID
GetCommConfig
LockResource
CreateFileMappingW
CreateSemaphoreW
SetLastError
GetModuleHandleW
GetCurrentProcess
CancelIo
GlobalFree
FindClose
DeleteCriticalSection
GetSystemWindowsDirectoryA
lstrlenW
DuplicateHandle
GetLocaleInfoW

Exports

Exports

?RemoveDateTimeA@@YGPA_NPAJEM&U
?KillPointOld@@YGIJ&U
?FormatMediaTypeW@@YGXIGN&U
?HideDataNew@@YGXEMFK&U
?IsValidHeightEx@@YGJPAIKGD&U
?ShowAppNameExA@@YGPAEMEPAM&U
?OnKeyboardEx@@YGFGHG&U
?SendProvider@@YGGHN&U
?EnumListItemW@@YGXM&U
?KillStringW@@YGXPAEFMPAN&U
?InvalidateSemaphoreW@@YGX_N&U
?RemoveTaskNew@@YGGPAFF&U
?GenerateKeyNameNew@@YGPAXJHHG&U
?SetSemaphoreOld@@YGXEPAIDN&U
?IsNotAppNameOld@@YGPAMDM&U
?ModifyThreadOriginal@@YGFPAFIPAFJ&U
?IsValidListExA@@YGPAMPAMFFD&U
?ModifyFile@@YGPAXDE&U
?ShowListItemEx@@YGXPAJPAIEM&U
?GetValueOld@@YGPADKIPAMJ&U
?ValidatePathW@@YGGEKEM&U
?CancelDirectoryExA@@YGPADHG&U
?ModifyCharExA@@YGGD&U
?FormatSemaphoreExW@@YGPAXM&U
?KillSystemExW@@YGPADJM&U
?ShowCommandLineA@@YGKJPAD&U
?CrtVersionExW@@YGPAMKPAJH&U
?LoadTimeOld@@YGPAXMKPAIE&U
?FreeStateExW@@YGNPAID&U
?InvalidateDateTimeOriginal@@YGGPAD&U
?KillProjectNew@@YGMPAGGPAMM&U
?IsNotMonitorEx@@YGDPA_NH&U

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imp
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.exp
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.byte1
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.byte0
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a19f906be794bf4d9d371863a7a6a0c

Headers

File Characteristics

PDB Paths

Imports

gdi32

comctl32

user32

msvcrt

comdlg32

kernel32

Exports

Exports

Sections

.text Size: 99KB - Virtual size: 99KB

.imp Size: 1KB - Virtual size: 1KB

.exp Size: 1KB - Virtual size: 1KB

.byte1 Size: 512B - Virtual size: 32B

.code Size: 512B - Virtual size: 32B

.byte0 Size: 512B - Virtual size: 44B

.data Size: 13KB - Virtual size: 13KB

.rdata Size: 6KB - Virtual size: 43KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 99KB - Virtual size: 99KB

.imp
Size: 1KB - Virtual size: 1KB

.exp
Size: 1KB - Virtual size: 1KB

.byte1
Size: 512B - Virtual size: 32B

.code
Size: 512B - Virtual size: 32B

.byte0
Size: 512B - Virtual size: 44B

.data
Size: 13KB - Virtual size: 13KB

.rdata
Size: 6KB - Virtual size: 43KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 2KB - Virtual size: 1KB