a43090797231793e7e0ab258b9c7eb5f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a43090797231793e7e0ab258b9c7eb5f_JaffaCakes118
Size

82KB
MD5

a43090797231793e7e0ab258b9c7eb5f
SHA1

0e995177f5a4d3f213408362b383be384241c977
SHA256

539dc65553cc7c16192e8a9d20842fc9c21420f30888e38200c982a8a8170c97
SHA512

b3db8025bad97d8e9a6062523a300ddb40e6976101ea2337d20c1391a2b6f4abd1ddfab09cdfab570b0f4fe297788576b24bc2f789eaf6fe8fa75f454508342c
SSDEEP

768:nkiRZ3QauaI7Q5F1J5npY+hVCvf0yRf4hTnxEnRO99kl+GwCvJED9m1rnlYNcKbL:NdQaualF1HnrXZen099kZlwcHgjX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a43090797231793e7e0ab258b9c7eb5f_JaffaCakes118

Files

a43090797231793e7e0ab258b9c7eb5f_JaffaCakes118
.dll windows:5 windows x86 arch:x86

92f4f7da21c96b82faaab3c3bf93513c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Source\FDM\trunc\bin\Release\fdmumsp.pdb

Imports

kernel32

CloseHandle
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
LocalFree
GetVersionExW
CreateMutexW
GetLastError
InterlockedDecrement
WaitForSingleObject
ReleaseMutex
OpenProcess
GetCurrentProcessId
CreateEventW
SetEvent
GetTickCount
GetCurrentThreadId
GlobalLock
GlobalUnlock
GetModuleHandleW
GetProcAddress
lstrlenA
MultiByteToWideChar
OpenMutexW
InterlockedIncrement
GetStringTypeW
LCMapStringW
EncodePointer
DecodePointer
GetCommandLineA
RaiseException
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
Sleep
HeapSize
ExitProcess
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlUnwind
HeapReAlloc
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString

Exports

Exports

fdmumspy_findRequest

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92f4f7da21c96b82faaab3c3bf93513c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 600B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 600B

.reloc
Size: 7KB - Virtual size: 6KB