76ee16c355271b57abb8cb736927f6ab_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

76ee16c355271b57abb8cb736927f6ab_JaffaCakes118
Size

210KB
MD5

76ee16c355271b57abb8cb736927f6ab
SHA1

4a08653fabb16b9fd2708bb52324ff32b846a94c
SHA256

7f35e468e80c1308ece5480c4b6ce2ef8e98dd07f98014c6dacbccdef3e3f0ac
SHA512

6422d2585b3e22be9436290bd25ba4792d5c43aa5fd5b5833796e7f26b82732042603512642590957d6542bf8df17a46ff3af48c59f8b4e4a13da299244a326a
SSDEEP

3072:m0EYesvxd9s6PWmLZQ4n9cpEX5YEiLDIlpkhr8uhdS5HSlptWx1rV/trUJ+3LyWz:nbh7PnW+YFLELk6u86irtZU02WbS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76ee16c355271b57abb8cb736927f6ab_JaffaCakes118

Files

76ee16c355271b57abb8cb736927f6ab_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

797e067674a9d51349946bf9db1c75b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

OEMigLib.pdb

Imports

ntdll

RtlUnwind

kernel32

InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
lstrcpynA
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
FreeLibrary
GetProcAddress
GetModuleFileNameA
LoadLibraryA
GetLastError
DisableThreadLibraryCalls
GetCommandLineA
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
DeleteCriticalSection
GetEnvironmentStringsW
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
InterlockedExchange
FreeEnvironmentStringsW

ole32

CoCreateInstance
CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree

user32

SetWindowTextA
SetWindowLongA
MessageBoxA
LoadStringA
GetWindowTextA
GetDlgItem
EndDialog
GetWindowLongA
CheckDlgButton
DialogBoxParamA
EnableWindow
IsDlgButtonChecked
CharPrevA
SendMessageA
SetFocus

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shlwapi

StrStrIA
PathRemoveFileSpecA
wnsprintfA
StrCatBuffA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
OE5SimpleCreate

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 177KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

797e067674a9d51349946bf9db1c75b2

Headers

File Characteristics

PDB Paths

Imports

ntdll

kernel32

ole32

user32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 177KB - Virtual size: 178KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 177KB - Virtual size: 178KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 1KB