70305050fb77f23ba41833d9ed2746dd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

70305050fb77f23ba41833d9ed2746dd_JaffaCakes118
Size

146KB
MD5

70305050fb77f23ba41833d9ed2746dd
SHA1

041e5fa5d6cf207e9cf69d432150602870cad153
SHA256

e4d967b0ad036bd0e604b64d4fd48a43640258c7c902bc6a0639b17559520e3f
SHA512

807d1f8dd078d624641d7a88808c5b990df5c300188d49b99b364874f37f30e1e386dd64aad937ab50fc13d2db38cea0d9fa357c417771f5808abd6dd1007c82
SSDEEP

3072:RgJMEAJRIceGs5Oxuvrtpmco4JbBDt5RBdrE2mH:RlZPIceGsOxQrO4fDRyH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70305050fb77f23ba41833d9ed2746dd_JaffaCakes118

Files

70305050fb77f23ba41833d9ed2746dd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ee374c8079b3799c83f7dce0e24db861

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\Skype\hf\binary\win_msvc10_x86_release\web_browser\internet_explorer\SkypeIEPluginBroker.pdb

Imports

kernel32

LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
SetEvent
GetCommandLineW
SizeofResource
CreateEventW
CreateThread
CloseHandle
WaitForSingleObject
GetStringTypeW
LCMapStringW
WideCharToMultiByte
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
Sleep
FreeLibrary
LoadLibraryW
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
HeapReAlloc
HeapCreate
GetStdHandle
WriteFile
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
HeapFree
HeapAlloc

user32

DispatchMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PostThreadMessageW
CharUpperW
GetMessageW
TranslateMessage
CharNextW

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW

ole32

CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize
StringFromGUID2
CoCreateInstance
CoRegisterClassObject
CoTaskMemFree
CoInitialize

oleaut32

BSTR_UserSize
SysFreeString
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
VarUI4FromStr
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

rpcrt4

IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
NdrStubCall2
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 512B - Virtual size: 51B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rorpc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee374c8079b3799c83f7dce0e24db861

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

Sections

.text Size: 44KB - Virtual size: 44KB

.orpc Size: 512B - Virtual size: 51B

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 7KB - Virtual size: 6KB

.rorpc Size: 60KB - Virtual size: 60KB

.text
Size: 44KB - Virtual size: 44KB

.orpc
Size: 512B - Virtual size: 51B

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 7KB - Virtual size: 6KB

.rorpc
Size: 60KB - Virtual size: 60KB