5ea0c79271adfdb6bdb765e615a45f42_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5ea0c79271adfdb6bdb765e615a45f42_JaffaCakes118
Size

98KB
MD5

5ea0c79271adfdb6bdb765e615a45f42
SHA1

e18eed46fc3550455d1c83ddd4afdb6eb7295544
SHA256

c659df9b8b0616ebe21acb04b56ce9786d3a5a363e17e06e2336abb2041a4f7c
SHA512

8258106073d198e217f8962a638cd5593de77399803db86c23db538d1d48286f82d6b108eb5d4d911a4babe1da402fdc72596f913af9bebaa7500718f92bad62
SSDEEP

1536:MknbrfMAfOqRiNEBOKtBjUdrEE/8g5XP/kWBhfhPRBg0Z+GNZFu09NN5hHSU:9UiOqRiNoXBjUdFJkWpk0jZu85kU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ea0c79271adfdb6bdb765e615a45f42_JaffaCakes118

Files

5ea0c79271adfdb6bdb765e615a45f42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c28013136eb0c7a67d9082bebbf5eac3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\DailyBuild\sources\Nero8_CHILI5_RELEASE\Nero\bin\Release\NeDwFileHelper.pdb

Imports

msvcp80

??0?$allocator@_W@std@@QAE@XZ
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?max_size@?$allocator@_W@std@@QBEIXZ
??0?$allocator@_W@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

mfc80u

ord774
ord293
ord3927
ord283
ord1908
ord744
ord1476
ord4100
ord762
ord2260
ord5342
ord555
ord1197
ord566
ord757
ord6700
ord282
ord2895
ord870
ord1479
ord280
ord577
ord776
ord6171
ord899
ord764
ord3990

msvcr80

exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
wprintf
_wsplitpath_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
__CxxFrameHandler3
memset
_unlock

kernel32

GetProcAddress
LoadLibraryW
DeleteFileW
CopyFileW
SetFileAttributesW
GetModuleHandleW
GetCommandLineW
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rrdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c28013136eb0c7a67d9082bebbf5eac3

Headers

File Characteristics

PDB Paths

Imports

msvcp80

mfc80u

msvcr80

kernel32

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.rrdata Size: 72KB - Virtual size: 72KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.rrdata
Size: 72KB - Virtual size: 72KB