aa67cf30fe55570e0f3a709c59565ea6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa67cf30fe55570e0f3a709c59565ea6_JaffaCakes118
Size

372KB
MD5

aa67cf30fe55570e0f3a709c59565ea6
SHA1

c96fcf6e52d7c48e04a06dc640a8dc2941fe4307
SHA256

d1569b79f034859adbd774b2ae0c40e988214ac503b81827a648a229b04f4b27
SHA512

33f268883216acc9c7c9a09fd3c3fecef9c1911b552f533ecf5dc9086da41df6b73b14ee017381fc8c28da8941ea8b29e4973b569da5d69f67b26370f7a2e49c
SSDEEP

1536:GB/fVjYBQHIghZXiaERf9xJq6YY77rau5qGW/9yQaQc7TwMX14IN:dmzXs97q6YY77X5MyQabYMD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa67cf30fe55570e0f3a709c59565ea6_JaffaCakes118

Files

aa67cf30fe55570e0f3a709c59565ea6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec1390a6406ce58755a0ac7c669fd426

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Prj\code\ClientLib_Build_35_ForCompileOnly\bin\Release\AccountReg.pdb

Imports

mfc71

ord2248
ord764
ord762
ord6090
ord2372
ord1054
ord3830
ord3605
ord3641
ord3908
ord5915
ord1620
ord1617
ord3946
ord1402
ord4244
ord5152
ord1908
ord5073
ord6275
ord4185
ord5214
ord3403
ord4722
ord4282
ord1600
ord5960
ord5235
ord5233
ord923
ord928
ord932
ord930
ord934
ord2390
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5175
ord1964
ord1656
ord1655
ord5200
ord2862
ord2991
ord757
ord572
ord1614
ord760
ord1482
ord1084
ord3210
ord1934
ord3161
ord1280
ord1063
ord3302
ord1279
ord5637
ord2367
ord1545
ord4232
ord1599
ord587
ord2085
ord3162
ord4017
ord5182
ord4890
ord2020
ord1671
ord1670
ord1551
ord5912
ord1401
ord5203
ord4262
ord3182
ord605
ord354
ord1794
ord3397
ord2272
ord578
ord297
ord4108
ord4109
ord2902
ord6179
ord577
ord300
ord4106
ord1485
ord4107
ord283
ord709
ord602
ord1929
ord347
ord501
ord911
ord304
ord1395
ord4580
ord3596
ord566
ord3333
ord4261
ord4481
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2838
ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord3683
ord4486
ord4541
ord1207

msvcr71

sscanf
strchr
_setmbcp
strstr
strncpy
__CxxFrameHandler
malloc
free
_resetstkoflw
_except_handler3
sprintf
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_controlfp
memset
__security_error_handler
__dllonexit
_onexit

kernel32

GetModuleFileNameA
WideCharToMultiByte
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
InterlockedExchange
GetLocaleInfoA
GetACP
GetVersionExA
GetThreadLocale

user32

IsIconic
SetWindowRgn
GetClientRect
GetDC
ReleaseDC
GetParent
EnableWindow
PostMessageA
SetFocus
GetSystemMetrics
SendMessageA
DrawIcon
LoadIconA
LoadBitmapA

gdi32

BitBlt
CreateCompatibleDC
CombineRgn
CreateRectRgn
GetPixel

comctl32

ord17

oleaut32

SysAllocString
VariantClear

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 312KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.MMM
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ec1390a6406ce58755a0ac7c669fd426

Headers

File Characteristics

PDB Paths

Imports

mfc71

msvcr71

kernel32

user32

gdi32

comctl32

oleaut32

msvcp71

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 404B

.rsrc Size: 312KB - Virtual size: 309KB

.MMM Size: 28KB - Virtual size: 28KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 404B

.rsrc
Size: 312KB - Virtual size: 309KB

.MMM
Size: 28KB - Virtual size: 28KB