ace419b1543df8baeceee52ac9a350f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ace419b1543df8baeceee52ac9a350f6_JaffaCakes118
Size

172KB
MD5

ace419b1543df8baeceee52ac9a350f6
SHA1

b522986368fbb5a1abb1f1f1d848b39a658fb964
SHA256

6ad57b7b3a5b5dde0cbac957c88318b9dd25b2b825302ce58ec77b4e90eb27ea
SHA512

e5979849cfe504d66b2eea05a336821ebf255590efe84d74d3acb7c75a5493189b7deec79ef533360da0f33a8bbf75f46c7875d82580a14f78e1db91266f9d2c
SSDEEP

3072:WQGJTVJ8nJh+bMf1/Xr6lUDa1/LuvSkdyJt3HBd+Grt76ES88ga2YAF+v0:W7JTVJ8JAbMx6lUDapSUZHBd+CFSqa2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ace419b1543df8baeceee52ac9a350f6_JaffaCakes118

Files

ace419b1543df8baeceee52ac9a350f6_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

9390e56c6f52007d1d8bfd7ebfd48c75

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MSDAOSP.pdb

Imports

msvcrt

_initterm
_adjust_fdiv
_mbsinc
_ftol
floor
wcscmp
_wcsicmp
wcsncpy
_except_handler3
memmove
wcslen
malloc
??3@YAXPAX@Z
atol
??2@YAPAXI@Z
wcschr
mbstowcs
free
realloc
_purecall

kernel32

VirtualAlloc
LoadLibraryA
CompareStringA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
DisableThreadLibraryCalls
GetSystemDefaultLCID
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
DeleteCriticalSection
InitializeCriticalSection
GetSystemInfo
GetCurrentThread
GetProcAddress
GetModuleHandleA
GetCurrentProcessId

user32

LoadStringA
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
LoadStringW
wsprintfA

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegDeleteKeyA

ole32

CoGetMalloc
ProgIDFromCLSID
StringFromCLSID
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree

oleaut32

VariantInit
SysAllocString
SysStringLen
VariantCopy
VariantClear
SysAllocStringLen
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9390e56c6f52007d1d8bfd7ebfd48c75

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 4KB - Virtual size: 308B

.rsrc Size: 104KB - Virtual size: 102KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 4KB - Virtual size: 308B

.rsrc
Size: 104KB - Virtual size: 102KB

.reloc
Size: 4KB - Virtual size: 2KB