853634b894f9433a6174343dd362f247_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

853634b894f9433a6174343dd362f247_JaffaCakes118
Size

204KB
MD5

853634b894f9433a6174343dd362f247
SHA1

7e2fb259450df0cde0f58cdc21918d9bec3d0efd
SHA256

f8e6456741eb13a6b36aec4fa2f9369e891b53e66c8772da3f5e18f8b6382ff1
SHA512

2a20c24a88d10443e156ca7c9cb7f91008c342746a96a941d43f5603970b4d9469db9e2d1545c323187cf7a285aed72476195b501353ba53ea24ffec5d49f4dc
SSDEEP

3072:Uu3zc1zsLYCVO8epEZHqkRt3yOQQSkW14pY6aqeDpfHgq3mr9KF/M9qCtFMmAHz2:xjc1zsLvO8epPkRt3LC6cBUgXcamA9Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
853634b894f9433a6174343dd362f247_JaffaCakes118

Files

853634b894f9433a6174343dd362f247_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1853f051c28da8414fb591b38ef802ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\work\vc5\Process\Processjs\bin\Processjs.pdb

Imports

psapi

EnumProcessModules
GetModuleBaseNameW

mfc71u

ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord757
ord3824
ord266
ord2708
ord4301
ord2829
ord2725
ord2531
ord1162
ord1087
ord1079
ord1200
ord314
ord1170
ord1168
ord1192
ord1115
ord371
ord1093
ord1199
ord1197
ord1033
ord315
ord765
ord5562
ord581
ord764
ord762
ord3677
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579

msvcr71

__CxxFrameHandler
_purecall
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
__security_error_handler
free
_except_handler3
memset
getc
fputc
fflush
ftell
fseek
fwrite
fread
fclose
fopen

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
LocalFree
SetProcessPriorityBoost
GetProcessPriorityBoost
GetCurrentProcessId
GetPriorityClass
OpenProcess
Process32FirstW
CloseHandle
WideCharToMultiByte
GetVersionExA
GetSystemTimeAsFileTime
SetPriorityClass

msvcp71

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

cximage

?GetC@CxMemFile@@UAEJXZ
?PutC@CxMemFile@@UAE_NE@Z
?Error@CxMemFile@@UAEJXZ
?Eof@CxMemFile@@UAE_NXZ
?Flush@CxMemFile@@UAE_NXZ
?Size@CxMemFile@@UAEJXZ
?Tell@CxMemFile@@UAEJXZ
?Seek@CxMemFile@@UAE_NJH@Z
?Write@CxMemFile@@UAEIPBXII@Z
?Read@CxMemFile@@UAEIPAXII@Z
?Close@CxMemFile@@UAE_NXZ
??0CxMemFile@@QAE@PAEK@Z
??0CxImage@@QAE@ABV0@_N11@Z
??0CxImage@@QAE@K@Z
?Destroy@CxImage@@QAE_NXZ
??1CxMemFile@@UAE@XZ

js32

JS_ValueToInt32
JS_NewStringCopyZ
JS_EnumerateStub
JS_ConvertStub
JS_ResolveStub
JS_PropertyStub

javascriptparse

?GetPrivate@CJavaScript@@QAEPAXPAUJSObject@@@Z
?GetJavaScript@@YAPAVCJavaScript@@XZ
?SetPrivate@CJavaScript@@QAE_NPAUJSObject@@PAX@Z
?AddClass@CJavaScript@@QAEPAUJSObject@@PAU2@0PAUJSClass@@P6AHPAUJSContext@@0IPAJ3@ZIPAUJSPropertySpec@@PAUJSFunctionSpec@@56@Z
?NewObject@CJavaScript@@QAEPAUJSObject@@PAU2@PAUJSClass@@0@Z

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXABV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?Open@CxIOFile@@QAE_NPBD0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
getdevops

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1853f051c28da8414fb591b38ef802ca

Headers

File Characteristics

PDB Paths

Imports

psapi

mfc71u

msvcr71

kernel32

msvcp71

cximage

js32

javascriptparse

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 176KB - Virtual size: 180KB

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 176KB - Virtual size: 180KB

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 4KB - Virtual size: 2KB