712c24542e976c2ab382842feb8ef6a3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

712c24542e976c2ab382842feb8ef6a3_JaffaCakes118
Size

52KB
MD5

712c24542e976c2ab382842feb8ef6a3
SHA1

a5bb44d1fc005864dbc9e7be6ada27f5b6acb485
SHA256

97328f8c7d2f4d2a1725b32d6ae011e4eac996b15e4216e558c7970779e7898d
SHA512

dc4e80295246ccae0571f0cc8ca5a8bd7ac27f681887b461480a949e6bf0cc7e2cb3681605d88bac1d47e230199eabd3bb9ce72222ae16a06337200c8e18b44e
SSDEEP

1536:lx6i65V40uZdNCXrjFxfWN6ffyuA+fR3pqoo:le40utCXn+N0a63pC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VIP Menu.dll

Files

712c24542e976c2ab382842feb8ef6a3_JaffaCakes118
.rar
VIP Menu.dll
.dll windows:5 windows x86 arch:x86

ed85f1dd65b6a726b0279c2aed4ec3ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\Markus\Desktop\VIP Menu\VIP Menu\Release\VIP Menu.pdb

Imports

kernel32

VirtualAlloc
GetModuleHandleA
DisableThreadLibraryCalls
GetTickCount
GetCurrentThreadId
GetPrivateProfileIntA
FlushInstructionCache
GetCurrentProcess
VirtualQuery
MulDiv
CreateThread
VirtualProtect
Sleep
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
InterlockedCompareExchange
InterlockedExchange
OutputDebugStringA
IsProcessorFeaturePresent

user32

keybd_event
GetAsyncKeyState
GetSystemMetrics
SetRect

gdi32

ExtTextOutA
GetTextExtentPoint32A
SetTextColor
DeleteDC
CreateDIBSection
CreateFontA
GetDeviceCaps
SetBkColor
DeleteObject
SelectObject
CreateCompatibleDC
SetMapMode
SetTextAlign

shell32

ShellExecuteA

msvcr90

_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
__CxxFrameHandler
_ftol
_finite
_CIacos
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
ceil
_mbsnbcpy
malloc
sprintf
memcpy
_CIsqrt
_vsnprintf
memset

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

Sections

_TEXT
Size: 512B - Virtual size: 431B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed85f1dd65b6a726b0279c2aed4ec3ec

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

msvcr90

advapi32

Sections

_TEXT Size: 512B - Virtual size: 431B

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 11KB - Virtual size: 13KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 6KB - Virtual size: 6KB

_TEXT
Size: 512B - Virtual size: 431B

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 11KB - Virtual size: 13KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 6KB - Virtual size: 6KB