663411cad9bf1dc3c3973dd30c0a5d9b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

663411cad9bf1dc3c3973dd30c0a5d9b_JaffaCakes118
Size

101KB
MD5

663411cad9bf1dc3c3973dd30c0a5d9b
SHA1

08babd2e87dc5476c9f280c4f1eb45b23e96e6c5
SHA256

71b17b7c4cb1c5922452c1a223f36551c5969b560b5aa62b86c9b21b2d882f97
SHA512

c17dbdce209d7b782da69389914d674f48ee1d262e515f0816f8970fe296633d45f61dabac44ae7793a6c827fc5d6fe8df6fd8a08964a25e295574588b308f6f
SSDEEP

3072:kZjvwbcHnfGgAwmox9UREaYc4ahulmPOq:nbcHnfHJLuhpPR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
663411cad9bf1dc3c3973dd30c0a5d9b_JaffaCakes118

Files

663411cad9bf1dc3c3973dd30c0a5d9b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

5a7bfe668f2437c5ed4ea520192ebad8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\rnnuelbvml\UirnjRbXKbvhzt\swRUwbrndYiwoh.pdb

Imports

shlwapi

StrStrIA
StrToIntExW

gdi32

SetPixel
PtInRegion
CreatePenIndirect
TranslateCharsetInfo
ResizePalette
GetFontData
GetObjectW
DPtoLP
SetDIBits
GetTextColor
GetViewportOrgEx
GetTextMetricsA
GetClipBox
CreateHalftonePalette
RectVisible
CreateRoundRectRgn
GetPixel
Rectangle
DeleteObject

user32

IsIconic
SendDlgItemMessageW
IsDialogMessageA
keybd_event
CharLowerBuffW
GetDialogBaseUnits
GetMenuStringW
GetWindow
DrawAnimatedRects
GetDlgItemTextW
InsertMenuItemW
GetUpdateRect
HiliteMenuItem
CharToOemW
GetSubMenu
LoadCursorW
LoadBitmapA
CreatePopupMenu
GetNextDlgTabItem
IsMenu
SetUserObjectInformationW
AppendMenuA
LookupIconIdFromDirectory
SendDlgItemMessageA
DrawEdge
DefDlgProcW
SetWindowLongA
CreateWindowExW
GetLastActivePopup
GetUserObjectInformationA
DrawFrameControl
SetForegroundWindow
CopyImage
GetScrollPos
CreateCaret
DrawMenuBar
GetFocus
GetKeyState
SendInput
CopyRect
PostQuitMessage
InSendMessage
GetMenu
InsertMenuA
RegisterWindowMessageA

msvcrt

toupper
setlocale
_controlfp
__set_app_type
__p__fmode
iswxdigit
wcstod
setvbuf
__p__commode
_amsg_exit
isprint
_initterm
localtime
getc
atol
_acmdln
malloc
strcspn
exit
_ismbblead
_XcptFilter
fgets
isupper
_exit
_cexit
__setusermatherr
__getmainargs

kernel32

SleepEx
CompareStringA
GetAtomNameW
SetTimerQueueTimer
GetTickCount
FlushFileBuffers
OpenEventA
FindFirstChangeNotificationW
GetVersionExA
GetModuleHandleA
GetLocaleInfoA
SearchPathA
lstrcpyA
GetModuleFileNameA
GlobalAddAtomW
OpenFile
GetCommConfig
LocalSize
ResumeThread
GetAtomNameA
GetComputerNameW
GetLocaleInfoW
GlobalMemoryStatusEx

Exports

Exports

InstallU
?ValidateCharA@@YGFI~U
?InvalidateDeviceOriginal@@YGHJ~U
PluginCommand
?GlobalDialogA@@YGMJPADPAID~U
PluginMain
PluginName
?KillMemoryExA@@YGPAXHK~U
PluginType
?RtlCommandLineW@@YGGDGPAM~U
?IsPointOriginal@@YGHPAHJM~U
?IncrementWidthExA@@YGPAJHGHF~U
?FindSystemNew@@YGXPAEPA_NPAI~U
?DeleteFile@@YGIJGG~U
PluginVersion
?ShowMutexNew@@YGGPAKPAIPAF~U
WSPStartup
?InsertMainStructDlhSi@@YGKGH@Z
?IsValidCommandLineOriginal@@YGFGPAEPAK~U

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.redt
Size: 1024B - Virtual size: 694B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rimp
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdbg1
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rit
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdbg2
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rvar
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rpt
Size: 1024B - Virtual size: 786B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ping
Size: - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a7bfe668f2437c5ed4ea520192ebad8

Headers

File Characteristics

PDB Paths

Imports

shlwapi

gdi32

user32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 20KB

.redt Size: 1024B - Virtual size: 694B

.rimp Size: 2KB - Virtual size: 2KB

.rdbg1 Size: 512B - Virtual size: 28B

.data Size: 2KB - Virtual size: 1KB

.rit Size: 1024B - Virtual size: 516B

.rdbg2 Size: 512B - Virtual size: 72B

.rvar Size: 512B - Virtual size: 44B

.rpt Size: 1024B - Virtual size: 786B

.hdata Size: 512B - Virtual size: 252B

.ping Size: - Virtual size: 79KB

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 20KB

.redt
Size: 1024B - Virtual size: 694B

.rimp
Size: 2KB - Virtual size: 2KB

.rdbg1
Size: 512B - Virtual size: 28B

.data
Size: 2KB - Virtual size: 1KB

.rit
Size: 1024B - Virtual size: 516B

.rdbg2
Size: 512B - Virtual size: 72B

.rvar
Size: 512B - Virtual size: 44B

.rpt
Size: 1024B - Virtual size: 786B

.hdata
Size: 512B - Virtual size: 252B

.ping
Size: - Virtual size: 79KB

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 1KB - Virtual size: 1KB