87c8eaa6c03e284b6aa6d58009b66520_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

87c8eaa6c03e284b6aa6d58009b66520_JaffaCakes118
Size

230KB
MD5

87c8eaa6c03e284b6aa6d58009b66520
SHA1

f650fc1615d9caad9f8be3089244108b91e7e525
SHA256

784a0cabad9ae707816a024a4102bcf4d4f755ad78a73e17c7c33bfedb332777
SHA512

95fe77e5f371f15897cb0264d9ee5641fa47da8bd72fd4097c4e4e0e743a9bb4af62ffece8cfcd90dba0954c0b48f39c1dc91eff7239714f4989762badcd3709
SSDEEP

3072:zUpj6NiqDzMFpPB94q1GR806JmDTgZidoBMdjE/L+/X9hXiN0TuzX/lg:4pj6NvzK5n4PmJmDTgZioBWc+f9sSur

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87c8eaa6c03e284b6aa6d58009b66520_JaffaCakes118

Files

87c8eaa6c03e284b6aa6d58009b66520_JaffaCakes118
.dll windows:6 windows x86 arch:x86

7a40941b33600c8ea5f255984f62c5f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

icardie.pdb

Imports

msvcrt

memcpy
_onexit
_lock
__dllonexit
_unlock
??3@YAXPAX@Z
_amsg_exit
_initterm
_XcptFilter
memset
realloc
??2@YAPAXI@Z
_adjust_fdiv
_errno
_purecall
_resetstkoflw
malloc
_wcsicmp
free

ole32

CoTaskMemAlloc
CoTaskMemFree
ProgIDFromCLSID
CoCreateInstance
CLSIDFromString
CoTaskMemRealloc

oleaut32

SafeArrayRedim
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayGetElement
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
VariantCopy
VariantClear
VariantChangeType
VarUI4FromStr
SetErrorInfo
CreateErrorInfo
LoadRegTypeLi
LoadTypeLi
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
SafeArrayAccessData
SafeArrayGetUBound
SysAllocStringLen

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersionExA
GetProcAddress
LoadLibraryExW
GetSystemDirectoryW
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleFileNameW
RaiseException
GetLastError
DisableThreadLibraryCalls
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
lstrcmpiW
FreeLibrary
LocalAlloc
lstrlenW
FormatMessageW
LocalFree
InterlockedDecrement
InterlockedIncrement

user32

UnregisterClassA
LoadStringW
CharNextW

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW

wininet

InternetGetSecurityInfoByURLW

shlwapi

ord158
ord156
UrlGetPartW

crypt32

CertSerializeCertificateStoreElement

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a40941b33600c8ea5f255984f62c5f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

oleaut32

kernel32

user32

advapi32

wininet

shlwapi

crypt32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 44KB

.data Size: 174KB - Virtual size: 173KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 44KB

.data
Size: 174KB - Virtual size: 173KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 2KB