5d39d5a9b7d23ccb1b3619abdcfc7926_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5d39d5a9b7d23ccb1b3619abdcfc7926_JaffaCakes118
Size

323KB
MD5

5d39d5a9b7d23ccb1b3619abdcfc7926
SHA1

4402d622bd7c8c7160856df1c214ed65411d6595
SHA256

8cc140f6a0e5f94005e421b80f5b4597a217baf74df99215837a43cb75758208
SHA512

044a9265c0e753c2b8cc3d0ae8da8d39ac70d8d76398ca56a6685080f5cd0d840d7c4b96dc51c383992abf7f37d2115e5a94db4797c8bf70341b984f2d268ec4
SSDEEP

6144:siT4htE7es3FInzIMjIj9soIIYvSSghgTNQmw2yU7sys5gU3o7gngnMaIwr+juMS:sgrl2cBJqGu1omge

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d39d5a9b7d23ccb1b3619abdcfc7926_JaffaCakes118

Files

5d39d5a9b7d23ccb1b3619abdcfc7926_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

b6e0b083fd9d212407b480fb998b379f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dplayx.pdb

Imports

ntdll

RtlUnwind

rpcrt4

UuidCreate

user32

wsprintfW
wsprintfA

kernel32

UnmapViewOfFile
GetCurrentProcessId
CreateMutexA
CreateEventA
MapViewOfFile
GetLastError
CreateFileMappingA
ReleaseMutex
SetEvent
WaitForSingleObject
GetTickCount
CreateThread
ResetEvent
lstrlenA
Sleep
FreeLibrary
GetVersionExA
DuplicateHandle
GetCurrentProcess
LoadLibraryW
LoadLibraryA
GetProcAddress
CreateEventW
CreateMutexW
CreateFileMappingW
OpenFileMappingW
OpenFileMappingA
CreateProcessW
CreateProcessA
GetCurrentDirectoryW
GetCurrentDirectoryA
CompareStringW
IsBadCodePtr
GetProfileIntA
InterlockedIncrement
InterlockedExchange
DisableThreadLibraryCalls
LocalFree
DebugBreak
IsBadReadPtr
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineW
GetCommandLineA
ExitThread
OpenProcess
ResumeThread
GlobalFree
GlobalAlloc
ReleaseSemaphore
CreateSemaphoreA
VirtualQuery
VirtualFree
VirtualAlloc
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetCPInfo
VirtualProtect
GetSystemInfo
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetModuleFileNameA
CreateFileA
CloseHandle
SetFilePointer
ReadFile
InterlockedDecrement
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CompareStringA
WaitForMultipleObjects

advapi32

RegQueryInfoKeyW
RegDeleteKeyA
RegDeleteKeyW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteValueA
RegEnumValueW
RegSetValueExA
RegSetValueExW
RegEnumKeyExA
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegDeleteValueW
RegEnumValueA

winmm

timeGetDevCaps
timeGetTime
timeSetEvent
timeKillEvent

Exports

Exports

DirectPlayCreate
DirectPlayEnumerate
DirectPlayEnumerateA
DirectPlayEnumerateW
DirectPlayLobbyCreateA
DirectPlayLobbyCreateW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
gdwDPlaySPRefCount

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6e0b083fd9d212407b480fb998b379f

Headers

File Characteristics

PDB Paths

Imports

ntdll

rpcrt4

user32

kernel32

advapi32

winmm

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 208KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 208KB - Virtual size: 208KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 12KB - Virtual size: 11KB