8c3021737767a7c79aa9d6da49e5a19b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8c3021737767a7c79aa9d6da49e5a19b_JaffaCakes118
Size

226KB
MD5

8c3021737767a7c79aa9d6da49e5a19b
SHA1

faf16e754f1bbdcde9ed24e7e027c4f064dd6617
SHA256

aee85f734b058d9823dfcdf037b83a4a58609252274b3bb8f18b8350c50fb19b
SHA512

86d1462628880fb6c7177fa5a9b409aaa0a4075db887ab4602d78907041ef67b4d16f9bc2693f3c8518669caf443aadbae6c1b9de30edc69dd1918a12af92880
SSDEEP

6144:7qL6E4ZkaCx2ZC9+SkFCKnicD8T8bnJLcREQ:uAkzxizSmCeicDPJkE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c3021737767a7c79aa9d6da49e5a19b_JaffaCakes118

Files

8c3021737767a7c79aa9d6da49e5a19b_JaffaCakes118
.dll windows:6 windows x86 arch:x86

7a40941b33600c8ea5f255984f62c5f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

icardie.pdb

Imports

msvcrt

memcpy
_onexit
_lock
__dllonexit
_unlock
??3@YAXPAX@Z
_amsg_exit
_initterm
_XcptFilter
memset
realloc
??2@YAPAXI@Z
_adjust_fdiv
_errno
_purecall
_resetstkoflw
malloc
_wcsicmp
free

ole32

CoTaskMemAlloc
CoTaskMemFree
ProgIDFromCLSID
CoCreateInstance
CLSIDFromString
CoTaskMemRealloc

oleaut32

SafeArrayRedim
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayGetElement
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
VariantCopy
VariantClear
VariantChangeType
VarUI4FromStr
SetErrorInfo
CreateErrorInfo
LoadRegTypeLi
LoadTypeLi
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
SafeArrayAccessData
SafeArrayGetUBound
SysAllocStringLen

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersionExA
GetProcAddress
LoadLibraryExW
GetSystemDirectoryW
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleFileNameW
RaiseException
GetLastError
DisableThreadLibraryCalls
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
lstrcmpiW
FreeLibrary
LocalAlloc
lstrlenW
FormatMessageW
LocalFree
InterlockedDecrement
InterlockedIncrement

user32

UnregisterClassA
LoadStringW
CharNextW

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW

wininet

InternetGetSecurityInfoByURLW

shlwapi

ord158
ord156
UrlGetPartW

crypt32

CertSerializeCertificateStoreElement

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a40941b33600c8ea5f255984f62c5f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

oleaut32

kernel32

user32

advapi32

wininet

shlwapi

crypt32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 44KB

.data Size: 170KB - Virtual size: 169KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 44KB

.data
Size: 170KB - Virtual size: 169KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 2KB