758ffc1bd005056672ccf35e3d1585eb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

758ffc1bd005056672ccf35e3d1585eb_JaffaCakes118
Size

180KB
MD5

758ffc1bd005056672ccf35e3d1585eb
SHA1

0c0617ee783a3a4523424b03d6e9615c13ab8578
SHA256

7b212e9156d90bce2d6258dacb2ce8280fd62bf7063064c5e783e2324d29ea4f
SHA512

96ddeea0b7bec0ef47a18d1794e218fbd7b59fb9b95c350e7f80edef508322e11e9abadc964792c83053e1d6db72d857684209b4fdd27944c9b4a2e09bd9f431
SSDEEP

3072:rTHNoxO3XASnozr0rv0xZyKcjD84p1P+hfWaRSy/9S5c8cO/Xzw6Hg:mO3Xmza0XKjDXAhF5S5c8c6XzwE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
758ffc1bd005056672ccf35e3d1585eb_JaffaCakes118

Files

758ffc1bd005056672ccf35e3d1585eb_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c89d4d3ccad51b9841628d5e02231ffc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\AutoBuild_Work\Source\bin\HdmvWriter.pdb

Imports

gemthread

??0GemObservable@@QAE@XZ
?addObserver@GemObservable@@UAEXPAVGemObserver@@@Z
?removeObserver@GemObservable@@UAEXPAVGemObserver@@@Z
?removeObservers@GemObservable@@UAEXXZ
?notifyObservers@GemObservable@@UAEXPAX@Z
?notifyObservers@GemObservable@@UAEXXZ
?hasChanged@GemObservable@@UBE_NXZ
?countObservers@GemObservable@@UBEIXZ
?destroyObservers@GemObservable@@UBEXXZ
?hasObserver@GemObservable@@UBE_NPBVGemObserver@@@Z
?setChanged@GemObservable@@MAEXXZ
?clearChanged@GemObservable@@MAEXXZ
??1GemObservable@@UAE@XZ
??0GemObserver@@QAE@XZ
??1GemObserver@@UAE@XZ

msvcr80

_unlock
__dllonexit
_lock
_onexit
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
?terminate@@YAXXZ
??2@YAPAXI@Z
__CxxFrameHandler3
??_V@YAXPAX@Z
??3@YAXPAX@Z
_purecall
__CppXcptFilter

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
RaiseException
LoadLibraryA
GetLastError
InterlockedExchange
FreeLibrary
GetProcAddress
LocalAlloc

Exports

Exports

??0ILHdmvWriterManager@@QAE@ABV0@@Z
??0ILHdmvWriterManager@@QAE@XZ
??1ILHdmvWriterManager@@MAE@XZ
??4ILHdmvWriterManager@@QAEAAV0@ABV0@@Z
??_7ILHdmvWriterManager@@6B@
?CreateHdmvWriterManager@Leonids@@YAPAVILHdmvWriterManager@@AAVILDvdStructManager@1@AAVILMediaDataManager@@AAVILTransitionManager@@@Z

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c89d4d3ccad51b9841628d5e02231ffc

Headers

File Characteristics

PDB Paths

Imports

gemthread

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 168KB - Virtual size: 169KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 772B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 168KB - Virtual size: 169KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 772B