4c97ac096a6c2b4f0e539e909cb7d8c4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4c97ac096a6c2b4f0e539e909cb7d8c4_JaffaCakes118
Size

432KB
MD5

4c97ac096a6c2b4f0e539e909cb7d8c4
SHA1

994fc6af5237a556094eb50ace7887e4315a48e4
SHA256

59069fbe1952d982001c5fe23d9b96f9b1739990e29b91ea17d1331658873311
SHA512

3017d10c5dc9afa8379097629460b3911307375309a591bf5d289a90c98a5503b4c60fed7290bcdacacda4dc89c46b2c781dbda9001d039e75ca7e3696d2d5dd
SSDEEP

6144:MV/Gj66GsqsirHBrNQeIZP3apYb85kUOQeewQeeFQeesQee/vQeefQeebwCWVdEW:R66Gs9R3Pqqb85kObdjnShkqbYaZri

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c97ac096a6c2b4f0e539e909cb7d8c4_JaffaCakes118

Files

4c97ac096a6c2b4f0e539e909cb7d8c4_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mpvis.pdb

Imports

msvcrt

??2@YAPAXI@Z
realloc
free
malloc
memset
??_V@YAXPAX@Z
wcschr
_vsnwprintf
wcspbrk
??3@YAXPAX@Z
_CIacos
_finite
longjmp
_setjmp3
isdigit
isspace
_CIpow
floor
_vsnprintf
exit
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
_CIatan2
_CIsqrt
rand
time
srand
_wcsicmp
_CIcos
_CIsin
??_U@YAPAXI@Z
_purecall
memcpy

ntdll

RtlUnwind

kernel32

GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DisableThreadLibraryCalls
lstrcpynW
GetModuleFileNameW
FreeLibrary
LockResource
LoadLibraryW
lstrcatW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
WaitForSingleObject
SetEvent
VirtualFree
FlushInstructionCache
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
InterlockedExchange
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
Sleep
InterlockedCompareExchange
IsProcessorFeaturePresent
GetVersionExA
FindResourceA
LocalAlloc
RaiseException
GetProcAddress

advapi32

RegOpenKeyA
RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
TraceMessage
RegQueryValueExW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VarUI4FromStr
LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysAllocStringLen

user32

IsWindow
FillRect
GetClientRect
GetDC
GetSystemMetrics
IsRectEmpty
SetRectEmpty
CopyRect
SetCursor
PostMessageW
DefWindowProcW
SetWindowLongW
ReleaseDC
CallWindowProcW
CallNextHookEx
GetAsyncKeyState
DestroyWindow
UnhookWindowsHookEx
GetSysColor
UpdateWindow
ShowWindow
SetWindowsHookExW
IsWindowUnicode
CreateWindowExW
RegisterClassW
LoadCursorW
MonitorFromWindow
GetWindowRect
CharPrevW
CharNextW
GetWindowLongW

gdi32

StretchBlt
SetBkColor
SetTextColor
TextOutW
SetStretchBltMode
DeleteObject
SetTextAlign
GetStockObject

gdiplus

GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipCreatePen2
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipSetPathGradientCenterColor
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPointI
GdipSetPathGradientFocusScales
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipStartPathFigure
GdipAddPathEllipseI
GdipCreatePathGradientFromPath
GdipCreateFromHDC
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipDrawLineI

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ole32

oleaut32

user32

gdi32

gdiplus

winmm

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 11KB - Virtual size: 11KB

.text Size: 94KB - Virtual size: 96KB

.text
Size: 285KB - Virtual size: 285KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 94KB - Virtual size: 96KB