862493f3b7244f3049aab17e58616b2f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

862493f3b7244f3049aab17e58616b2f_JaffaCakes118
Size

282KB
MD5

862493f3b7244f3049aab17e58616b2f
SHA1

6c510eebdd035dec1b8222cc7043d4933afc9ace
SHA256

6b430620cae99ffa0ca86988b4cf997a301784c3738f8260602867740968a93b
SHA512

57064021b49b7e51eed84c7d9614378c50671e8bb52ab2f5fffc4f823863c4660fc00520522f8556aa38dc5d1704d3b4b6658cda9f22c9ae7b50b285b5a1d208
SSDEEP

3072:fUyL6eA2LjSP0wTvmEm6yV+I2w9UQwQqI:8yL6/USPbTvdI2wyQc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
862493f3b7244f3049aab17e58616b2f_JaffaCakes118

Files

862493f3b7244f3049aab17e58616b2f_JaffaCakes118
.dll windows:6 windows x86 arch:x86

7a40941b33600c8ea5f255984f62c5f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

icardie.pdb

Imports

msvcrt

memcpy
_onexit
_lock
__dllonexit
_unlock
??3@YAXPAX@Z
_amsg_exit
_initterm
_XcptFilter
memset
realloc
??2@YAPAXI@Z
_adjust_fdiv
_errno
_purecall
_resetstkoflw
malloc
_wcsicmp
free

ole32

CoTaskMemAlloc
CoTaskMemFree
ProgIDFromCLSID
CoCreateInstance
CLSIDFromString
CoTaskMemRealloc

oleaut32

SafeArrayRedim
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayGetElement
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
VariantCopy
VariantClear
VariantChangeType
VarUI4FromStr
SetErrorInfo
CreateErrorInfo
LoadRegTypeLi
LoadTypeLi
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
SafeArrayAccessData
SafeArrayGetUBound
SysAllocStringLen

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersionExA
GetProcAddress
LoadLibraryExW
GetSystemDirectoryW
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleFileNameW
RaiseException
GetLastError
DisableThreadLibraryCalls
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
lstrcmpiW
FreeLibrary
LocalAlloc
lstrlenW
FormatMessageW
LocalFree
InterlockedDecrement
InterlockedIncrement

user32

UnregisterClassA
LoadStringW
CharNextW

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW

wininet

InternetGetSecurityInfoByURLW

shlwapi

ord158
ord156
UrlGetPartW

crypt32

CertSerializeCertificateStoreElement

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a40941b33600c8ea5f255984f62c5f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

oleaut32

kernel32

user32

advapi32

wininet

shlwapi

crypt32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 44KB

.data Size: 226KB - Virtual size: 225KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 44KB

.data
Size: 226KB - Virtual size: 225KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 2KB