a22565bfeec0e03295faabfe5f352fc1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a22565bfeec0e03295faabfe5f352fc1_JaffaCakes118
Size

379KB
MD5

a22565bfeec0e03295faabfe5f352fc1
SHA1

cd606566e8320e224b755af46aa614c6f3b7c8ba
SHA256

89dae85e02d2fdd78a8b8c7fc4450869e4839470f5b5b2a41b94b53c239377da
SHA512

c070576dfa8e508722085bf5b9237a81e6c6439af97fade7c04d6179ba37ac8c830cbefdd5f401c367eb0c5e0d6de4d9b376dddc2a8d05e2ef59139436f3e6e0
SSDEEP

6144:Q0FuRVp5VPDrE0Hyfry3h1mmclSJ+iTIbi5VjU1gwl4ESEznVbZV9MO1imK1Xn6o:JFKVp7PDrE0HyfryR1mmcl3JG01X4Ez0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a22565bfeec0e03295faabfe5f352fc1_JaffaCakes118

Files

a22565bfeec0e03295faabfe5f352fc1_JaffaCakes118
.dll windows:5 windows x86 arch:x86

79b98693f979d5974f1e5205c302765f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\videoeditor\rel32\videoeditor.pdb

Imports

ole32

CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance

user32

CharNextA
PostMessageA
GetClientRect
GetDC
ReleaseDC
SetWindowLongA
DefWindowProcA
CallWindowProcA
EndPaint
BeginPaint
GetUpdateRgn
GetMessageTime
GetMessagePos
GetWindowLongA
GetCursorPos
ReleaseCapture
SetCapture
CharUpperA
CharLowerA
GetSystemMetrics
CharPrevA
ClientToScreen
GetWindowRect
wsprintfA
GetWindowThreadProcessId
SystemParametersInfoA
IsIconic
PostQuitMessage
DispatchMessageA
TranslateMessage
PeekMessageA
ShowWindow
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
FlashWindow

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

gdi32

CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateCompatibleBitmap
GetObjectA
DeleteObject
GetDIBits
CreateDIBitmap

gdiplus

GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipAddPathLine2
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipDrawString
GdipDrawImageI
GdipCloneBrush
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetDC
GdipReleaseDC
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP

kernel32

DeleteFileA
GetVersionExA
GetDiskFreeSpaceA
LoadLibraryA
FreeLibrary
WaitForMultipleObjects
GetLocaleInfoA
GetProcessHeap
GetFileSize
HeapFree
SetThreadPriority
GlobalLock
GlobalUnlock
SetEnvironmentVariableA
CreateEventA
SetEvent
CreateFileA
GetFileSizeEx
SetFilePointer
ReadFile
WaitForSingleObject
CloseHandle
FindClose
FindNextFileA
FindFirstFileA
GetFileAttributesA
GetTickCount
GetCurrentProcessId
GetEnvironmentVariableA
GetCurrentThreadId
GlobalFree
InterlockedExchange
InterlockedCompareExchange
ResetEvent
IsDBCSLeadByte
GetModuleFileNameA
lstrlenW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetErrorMode
GetSystemInfo
GetVersion
GlobalAlloc
GlobalSize
CreateProcessA
Sleep
ReleaseMutex
CreateMutexA
GetSystemDirectoryA
HeapDestroy
HeapReAlloc
HeapSize
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
MultiByteToWideChar
lstrlenA
GetModuleHandleA
GetProcAddress
GetLastError
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
RaiseException

shell32

SHGetFolderPathA
ShellExecuteA
SHGetFileInfoA

oleaut32

SysStringLen
VariantInit
VariantClear
SysAllocString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
GetErrorInfo
VariantCopy
VariantChangeType
SysFreeString

shlwapi

PathCreateFromUrlA
PathCombineA

msvcr90

wcsnlen
strtol
_stricmp
ferror
fflush
exit
fprintf
sscanf
fscanf
realloc
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
sprintf
_vsnprintf
getenv
_stat32
strchr
strrchr
strstr
_ismbblead
strncpy
_access
_strnicmp
_putenv
printf
__iob_func
strnlen
_beginthreadex
memmove_s
atol
memcpy
fopen
fwrite
fclose
fseek
fread
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??8type_info@@QBE_NABV0@@Z
memset
??3@YAXPAX@Z
??_V@YAXPAX@Z
malloc
free
memcpy_s
strcpy_s
strncpy_s
??2@YAPAXI@Z
??_U@YAPAXI@Z
_wcsicmp
_resetstkoflw
_purecall
_recalloc
calloc

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

79b98693f979d5974f1e5205c302765f

Headers

File Characteristics

PDB Paths

Imports

ole32

user32

advapi32

version

gdi32

gdiplus

kernel32

shell32

oleaut32

shlwapi

msvcr90

msvcp90

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 208KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 12KB - Virtual size: 14KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 30KB - Virtual size: 29KB

.rmnet Size: 71KB - Virtual size: 72KB

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 12KB - Virtual size: 14KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 30KB - Virtual size: 29KB

.rmnet
Size: 71KB - Virtual size: 72KB