647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118
Size

1.2MB
MD5

647ced6c57034b0d2b3dbfc581b1c871
SHA1

df61383d0e2d7b1cb41625a71aed3f6d6c98f7d9
SHA256

481a3d4814bd1869ca7a614985112aa96bd2e6ddb817c079e60881870851966f
SHA512

af141b8e4478ccf37d80a0ae7ee38700d44b4721cd49b5feff950fc35d8ece73ab12b01ae811b3d68dddf7ce83750b852114463712ddbf49e9ba0af5425233df
SSDEEP

12288:AUfloZVVUYFoRS76wmBnKw+dTto2ylZJOV8b2j6Kk7GBwI8HBNh:AxVnos76XxKRdTto5Xb2XBwI8H1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118

Files

647ced6c57034b0d2b3dbfc581b1c871_JaffaCakes118
.dll windows:5 windows x86 arch:x86

7efa0c511d94114fd8ce30d2e10767db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\Admin\My Documents\Visual Studio 2008\Projects\DxtCF\Release\Dx.pdb

Imports

kernel32

IsBadReadPtr
GetSystemInfo
GetVolumeInformationA
CreateThread
VirtualProtect
GetModuleHandleA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WritePrivateProfileStringA
Sleep
GetPrivateProfileIntA
HeapFree
GetProcessHeap
HeapAlloc
InterlockedCompareExchange
InterlockedExchange
IsProcessorFeaturePresent
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetProcAddress
LoadLibraryA
GetVersionExA
GetTimeFormatA

user32

GetCursorPos
GetAsyncKeyState
wsprintfA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptHashData

msvcp90

?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

wininet

InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA

msvcr90

_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
exit
qsort
__CxxFrameHandler
iswspace
iswalpha
iswdigit
iswpunct
floor
_amsg_exit
_strdup
free
ldexp
sscanf
_vsnprintf
isspace
isdigit
_setjmp3
longjmp
_finite
_CIacos
strncpy
_ftol
_CIpow
??2@YAPAXI@Z
_time64
??3@YAXPAX@Z
srand
rand
malloc
clock
vsprintf_s
strstr
sprintf
memset
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
tmpfile
fclose
fwrite
fseek
setlocale
_CIsqrt
_CIsin
_CIcos
_CIatan2
fread
__CxxFrameHandler3

gdi32

GetGlyphOutlineA
CreateDIBSection
GetTextMetricsA
SelectObject
MoveToEx
ExtTextOutA
CreateCompatibleDC
SetMapMode
GetObjectW
GetObjectA
DeleteObject
DeleteDC
ExtTextOutW
SetTextAlign
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
SetBkColor
SetTextColor
GetCharacterPlacementW
GetCharacterPlacementA

Sections

.text
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 573KB - Virtual size: 51.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.v-lizer
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7efa0c511d94114fd8ce30d2e10767db

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp90

wininet

msvcr90

gdi32

Sections

.text Size: 338KB - Virtual size: 338KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 573KB - Virtual size: 51.3MB

.rsrc Size: 1024B - Virtual size: 688B

.v-lizer Size: 241KB - Virtual size: 241KB

.text
Size: 338KB - Virtual size: 338KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 573KB - Virtual size: 51.3MB

.rsrc
Size: 1024B - Virtual size: 688B

.v-lizer
Size: 241KB - Virtual size: 241KB