848e94eb0c5c62d3a5995d5f0a862a1a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

848e94eb0c5c62d3a5995d5f0a862a1a_JaffaCakes118
Size

52KB
MD5

848e94eb0c5c62d3a5995d5f0a862a1a
SHA1

ad144fe97a925d3c4787112020259b497d8988ba
SHA256

bab280748b1ae62db0bf9efb990ab15af90579979c9c61478679cb61bb712eb6
SHA512

5e878c33a9ce4eb51cd654d20446a531e67afaf230d2645f6a905f9b0ef1286ae0f633f92c08a24e8da12034fa9cb15bb66db19ee30a43aa6a0e7c004b4d0d6c
SSDEEP

768:PLQLBcUxAym/dhwJeZxuYyEt+DRfMdpF:TQLBc0hmIJeZ/t+DNMrF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
848e94eb0c5c62d3a5995d5f0a862a1a_JaffaCakes118

Files

848e94eb0c5c62d3a5995d5f0a862a1a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8930f2dffc4a0a31b6adfd44ebb45598

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\CLCVS\PCM\koan\Generic\branches\3.0\Src\koan\renderer\_rddetect.pdb

Imports

ddraw

DirectDrawCreateEx

kernel32

InitializeCriticalSection
DeleteCriticalSection
Sleep
SetProcessAffinityMask
GetModuleFileNameW
GetCurrentProcess
GetSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemPowerStatus
GetProcessAffinityMask
GetTickCount
ExitProcess
GetVersionExA

user32

wsprintfW

advapi32

RegCloseKey
RegQueryValueExW

python24

PyInt_FromLong
PyExc_TypeError
PyCObject_GetDesc
PyCObject_AsVoidPtr
PyObject_GetAttr
PyCObject_Type
_Py_NoneStruct
PyObject_CallObject
Py_BuildValue
PyCObject_FromVoidPtrAndDesc
PyDict_SetItemString
PyFloat_FromDouble
PyErr_Occurred
PyInt_AsLong
PyArg_ParseTuple
PyUnicodeUCS2_AsUnicode
PyType_IsSubtype
PyObject_SetAttrString
PyType_Type
PyExc_NameError
PyErr_SetString
PyString_FromString
PyUnicode_Type
PyModule_GetDict
Py_InitModule4

msvcp71

?_Nomemory@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z

msvcr71

??0exception@@QAE@ABV0@@Z
_except_handler3
free
__CxxFrameHandler
?terminate@@YAXXZ
__security_error_handler
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_callnewh
memset
_ftol
strstr
strncpy
sprintf
malloc
fprintf
??_V@YAXPAX@Z
_wtoi
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memmove
_CxxThrowException
swprintf
_wsplitpath
??3@YAXPAX@Z
wcscpy

Exports

Exports

init_rddetect

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8930f2dffc4a0a31b6adfd44ebb45598

Headers

File Characteristics

PDB Paths

Imports

ddraw

kernel32

user32

advapi32

python24

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 4KB - Virtual size: 3KB