89e24568bbf99671cc9e3ebf6095887a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

89e24568bbf99671cc9e3ebf6095887a_JaffaCakes118
Size

268KB
MD5

89e24568bbf99671cc9e3ebf6095887a
SHA1

d3a9fae74568ea2a1858ee72551c4bce25d7b8f7
SHA256

d3b228fda70e4e9812bcb31ef0baed45cad5975f792690b908ec289271949862
SHA512

d31999b0304b503d4a0eab8e0abe0e96e220504f2273b56225d2b7a48d4d1136cef982b533c5462445ea05074753fd67474d58ad12d619b2b4523cbef8033f4c
SSDEEP

6144:CapyvU+JOt9gb5YJusWRYd/EHs8+c1O8OkOsr8kCi:VEv3V5s8E/EHsEO8PyJi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89e24568bbf99671cc9e3ebf6095887a_JaffaCakes118

Files

89e24568bbf99671cc9e3ebf6095887a_JaffaCakes118
.dll windows:5 windows x86 arch:x86

0f38a60411b02ad0517eaf987c6b7aa6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\rpwmplyr\rel32\wmaimprtpln.pdb

Imports

ole32

CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetCurrentProcessId
GetLastError
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
IsDBCSLeadByte
GetModuleFileNameA
lstrcmpA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentThreadId
SetLastError
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
FindClose
LoadLibraryA
FindFirstFileA
DisableThreadLibraryCalls
SetErrorMode
Sleep
InterlockedExchange
EnterCriticalSection
RaiseException
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapAlloc
GetProcessHeap
HeapFree

user32

CreateAcceleratorTableA
RegisterClassExA
LoadCursorA
GetClassInfoExA
GetDesktopWindow
SetFocus
GetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameA
IsChild
SetWindowTextA
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
GetSysColor
GetClientRect
CallWindowProcA
CharNextA
UnregisterClassA
DefWindowProcA
FindWindowExA
GetWindowTextA
RegisterWindowMessageA
wsprintfA
RegisterClassA
GetSystemMetrics
SetCapture
GetWindowThreadProcessId
GetActiveWindow
GetParent
EnableWindow
SetWindowPos
ShowWindow
SendMessageA
IsWindow
GetDlgItem
DestroyWindow
CreateWindowExA
GetWindowLongA
SetWindowLongA
GetWindowTextLengthA

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcr90

_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
memcpy
realloc
_strlwr
printf
strrchr
sprintf_s
calloc
??2@YAPAXI@Z
_recalloc
strncpy_s
strstr
_resetstkoflw
??_V@YAXPAX@Z
memset
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_stricmp
_putenv
_crt_debugger_hook
fclose
fopen
atoi
sprintf
vfprintf
??3@YAXPAX@Z
free
malloc
memcpy_s
__CxxFrameHandler3
strncpy
??_U@YAPAXI@Z

oleaut32

LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
OleCreateFontIndirect

gdi32

GetDeviceCaps
DeleteObject
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
CreateSolidBrush
GetObjectA
GetStockObject

Exports

Exports

MPACreateComponentInstance

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f38a60411b02ad0517eaf987c6b7aa6

Headers

File Characteristics

PDB Paths

Imports

ole32

kernel32

user32

advapi32

msvcr90

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 177KB - Virtual size: 177KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 177KB - Virtual size: 177KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB