88df3b0a34e68bdf8ab9977c717ce8a4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

88df3b0a34e68bdf8ab9977c717ce8a4_JaffaCakes118
Size

431KB
MD5

88df3b0a34e68bdf8ab9977c717ce8a4
SHA1

302672fcdda0d0e8842c9b8fb17d9380f0b5911a
SHA256

2fef20c09da741458881c67e3074c3a7e0dde4841b84a2082e0c0f0b502b808d
SHA512

59dc54007d283ddb971d88c26624266b7eb084afa419cb76069cdb9b535cf9ddd55c3e83e460715410e32e951ccf47968dc9aaba7295630ae763cdcff24acd88
SSDEEP

6144:MV/Gj66GsqsirHBrNQeIZP3apYb85kUOQeewQeeFQeesQee/vQeefQeebwCWVdEJ:R66Gs9R3Pqqb85kObdjnShkqpYIp5HL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88df3b0a34e68bdf8ab9977c717ce8a4_JaffaCakes118

Files

88df3b0a34e68bdf8ab9977c717ce8a4_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mpvis.pdb

Imports

msvcrt

??2@YAPAXI@Z
realloc
free
malloc
memset
??_V@YAXPAX@Z
wcschr
_vsnwprintf
wcspbrk
??3@YAXPAX@Z
_CIacos
_finite
longjmp
_setjmp3
isdigit
isspace
_CIpow
floor
_vsnprintf
exit
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
_CIatan2
_CIsqrt
rand
time
srand
_wcsicmp
_CIcos
_CIsin
??_U@YAPAXI@Z
_purecall
memcpy

ntdll

RtlUnwind

kernel32

GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DisableThreadLibraryCalls
lstrcpynW
GetModuleFileNameW
FreeLibrary
LockResource
LoadLibraryW
lstrcatW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
WaitForSingleObject
SetEvent
VirtualFree
FlushInstructionCache
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
InterlockedExchange
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
Sleep
InterlockedCompareExchange
IsProcessorFeaturePresent
GetVersionExA
FindResourceA
LocalAlloc
RaiseException
GetProcAddress

advapi32

RegOpenKeyA
RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
TraceMessage
RegQueryValueExW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VarUI4FromStr
LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysAllocStringLen

user32

IsWindow
FillRect
GetClientRect
GetDC
GetSystemMetrics
IsRectEmpty
SetRectEmpty
CopyRect
SetCursor
PostMessageW
DefWindowProcW
SetWindowLongW
ReleaseDC
CallWindowProcW
CallNextHookEx
GetAsyncKeyState
DestroyWindow
UnhookWindowsHookEx
GetSysColor
UpdateWindow
ShowWindow
SetWindowsHookExW
IsWindowUnicode
CreateWindowExW
RegisterClassW
LoadCursorW
MonitorFromWindow
GetWindowRect
CharPrevW
CharNextW
GetWindowLongW

gdi32

StretchBlt
SetBkColor
SetTextColor
TextOutW
SetStretchBltMode
DeleteObject
SetTextAlign
GetStockObject

gdiplus

GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipCreatePen2
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipSetPathGradientCenterColor
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPointI
GdipSetPathGradientFocusScales
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipStartPathFigure
GdipAddPathEllipseI
GdipCreatePathGradientFromPath
GdipCreateFromHDC
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipDrawLineI

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ole32

oleaut32

user32

gdi32

gdiplus

winmm

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 11KB - Virtual size: 11KB

.text Size: 94KB - Virtual size: 96KB

.text
Size: 285KB - Virtual size: 285KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 94KB - Virtual size: 96KB