a3484a7373a345531de791afc6cd3f72_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a3484a7373a345531de791afc6cd3f72_JaffaCakes118
Size

182KB
MD5

a3484a7373a345531de791afc6cd3f72
SHA1

4e17d8efd2a7c675ab543e66ecac989a594a6455
SHA256

0bfa22bc1e7e4485cab66f7c982d1afad02323903cf31928c9238946029c8b3c
SHA512

884824cad9d9f0c7929b09af7fffbd856b102399233b74bab8d4c899c46bb030ddcb7889c2e83e16fe1bcbce594db01e9a024982bf0a1ba861bc50734ff36d56
SSDEEP

3072:rzqVov6hiPwiEO8YV/9Y8BpLeWnRrV8mOfdlPPP65v3PEmIIvSV3nu69xXUrih:rzquCcR3VpLRrqHPPP65vXaH9GS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3484a7373a345531de791afc6cd3f72_JaffaCakes118

Files

a3484a7373a345531de791afc6cd3f72_JaffaCakes118
.dll windows:4 windows x86 arch:x86

53df3b9f227019308aa4646a95387598

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenFile
_lclose
GlobalFree
WideCharToMultiByte
_lread
SetHandleCount
GlobalUnlock
LCMapStringW
LCMapStringA
RaiseException
LoadLibraryA
VirtualAlloc
HeapAlloc
HeapFree
GetStringTypeW
GetStringTypeA
GlobalLock
GlobalAlloc
lstrcpyA
LocalAlloc
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
GetEnvironmentStringsW
GetFileType
GetStdHandle
GetStartupInfoA
GetCPInfo
GetModuleFileNameA
FreeEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
LocalFree
GetEnvironmentStrings
MultiByteToWideChar
GetACP
FreeEnvironmentStringsA
GetOEMCP

user32

IntersectRect

recogn

RegisterRcgPercentCallbackFunc
recognize_solid_symbol_character
recognize_english_by_experts
init_recognizing_system
recognize_one_character
recognize_kana_character
close_recognizing_system
close_oecr_system
init_oecr_system

post

PostInit
PostLoad
PostClose
process_direction_of_hor_title
process_similar_character
GetUserDictionary
GetHiddenDictionary
PostMark
RegisterPostPercentCallbackFunc

ocrutil

set_attribute
block_alloc
subblock_free
get_attribute
line_alloc
char_free
line_free
char_alloc
OCR_GetProfileString
OCR_Timer
get_parameter_of_subblock
block_free
subblock_alloc
OCR_RecordSpaceInformation
OCR_RecordHorLineInformation
cpnt_free
cpnt_alloc
OCR_RecordVerLineInformation

memio

mem_bank_info
mem_free_bank
mem_create_bank
OCR_realloc
OCR_fopen
OCR_fclose
OCR_printf
mem_get_bank
OCR_malloc
OCR_free
mem_close_bank
mem_init_bank

fioall

_fioDecodeImg_BMP@24
_fioEncodeImg_TIF@20
_fioDecodeImg_PCX@24
_fioReadHeader_TIF@12
_fioDecodeImg_TIF@24
_fioReadHeader_PCT@12
_fioDecodeImg_PCT@24
_fioReadHeader_PCX@12
_fioReadHeader_BMP@12

segment

process_alpha_numeric_per_sblk
RegisterSegMarkCallbackFunc
close_blocking_per_image
free_RTF_info
close_blocking_system
close_lining_system
close_charing_system
init_blocking_system
init_lining_system
init_charing_system
process_capital_english_per_sblk
calculate_capital_height_per_table_blk
cut_char_of_subblock
seg_cut_line
Line_Post
end_edit_block
Save_Rtf_File
RegisterSegPercentCallbackFunc
seg_image_to_block
init_edit_block
get_page_dir_from_segmentation
get_line_gap_from_segmentation
process_english_by_size
Block_Post

codecvt

init_code_converter
close_code_converter
SetCodeParameter
Index_to_code
IndexPatch

Exports

Exports

PccrGetFileInfo
PccrOpenBinaryImage
PccrSaveBinaryImage
PccrSaveRtfFile
ProcessOnePageInDocument
ProcessSinglePage
RecogPage
RegisterPccrErrMsgCallbackFunc
RegisterPccrMarkCallbackFunc
RegisterPccrPercentCallbackFunc
RegisterPccrRcgWinCallbackFunc
RegisterPccrUpScrCallbackFunc
SegmentPage
_DCOCR_deskewImage@20
_DCOCR_free_attributeData@12
_DCOCR_free_imagePolygonRegions@12
_DCOCR_free_recognizedData@8
_DCOCR_get_attributeData@12
_DCOCR_get_recognizedData@12
_DCOCR_get_regionAttributeData@16
_DCOCR_imageDecomposition@12
_DCOCR_init@4
_DCOCR_load_database@12
_DCOCR_load_imageFile@8
_DCOCR_readImage@4
_DCOCR_set_CodePage@8
_DCOCR_set_DataType@8
_DCOCR_set_displayImage@8
_DCOCR_set_displayText@8
_DCOCR_set_displayWindowsInfo@8
_DCOCR_set_dotMatrix@8
_DCOCR_set_imageBufPointers@16
_DCOCR_set_imageDecomposition@8
_DCOCR_set_imageFile@12
_DCOCR_set_imageObjHandles@24
_DCOCR_set_imagePolygonRegions@12
_DCOCR_set_imageRegions@12
_DCOCR_set_imageResolution@8
_DCOCR_set_imageWhiteBitValue@8
_DCOCR_set_imageWidthLength@12
_DCOCR_set_language@8
_DCOCR_set_peekTextFunction@12
_DCOCR_set_regionDataType@12
_DCOCR_set_unrecognizedChar@8
_DCOCR_term@4
close_pccr_system
erase_and_recognize
init_pccr_system
load_database_of_pccr_system
merge_and_recognize
reset_working_space
split_and_recognize

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 86KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

53df3b9f227019308aa4646a95387598

Headers

File Characteristics

Imports

kernel32

user32

recogn

post

ocrutil

memio

fioall

segment

codecvt

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 7KB - Virtual size: 10KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 3KB - Virtual size: 3KB

.text Size: 86KB - Virtual size: 88KB

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 7KB - Virtual size: 10KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 86KB - Virtual size: 88KB