adde40e62eb8ce44b2ca6474d7ce3275_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

adde40e62eb8ce44b2ca6474d7ce3275_JaffaCakes118
Size

968KB
MD5

adde40e62eb8ce44b2ca6474d7ce3275
SHA1

7a5d990e951d91e5190530afcb47158679837895
SHA256

0dc0c190903154e3c4670dc6cf29e01031c6bb5a83314c0eebd07dec6e616c28
SHA512

4f67b09f445ab79f461a4bd2fc8202e21bf5db98e546e9d9433ab968d8b383f718a06d4877e095ffbc4a181ea69e84a746c737147c85990c2734276052530f0b
SSDEEP

24576:UQMvAOYKMuVLlvjG3exDmHwvIEh97FCU0TI6P:UrJYF6xkexDmQvIEh97FCUwI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adde40e62eb8ce44b2ca6474d7ce3275_JaffaCakes118

Files

adde40e62eb8ce44b2ca6474d7ce3275_JaffaCakes118
.dll windows:6 windows x64 arch:x64

4660817eafdc5d0e2dade29aed6a90c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
GlobalAlloc
GlobalFree
GetTickCount
SetProcessAffinityMask
CreateWaitableTimerA
SetDllDirectoryA
CopyFileExA
CreateActCtxA
AddRefActCtx
EnumUILanguagesA
GetConsoleCursorInfo
AddConsoleAliasA
GetSystemTimeAsFileTime
CreateThread
GetCurrentProcess
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetLastError
CloseHandle
RemoveDirectoryW
ReadFile
GetFileSize
FindFirstFileA
FindClose
DefineDosDeviceW
CreateFileW
GetProcessAffinityMask
GetStdHandle
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead

gdi32

GetLogColorSpaceA
GdiGetBatchLimit
GdiSetBatchLimit
CreateDIBSection
GetEnhMetaFilePixelFormat
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileA
PtInRegion
LineDDA
TranslateCharsetInfo
ExtCreateRegion
DeleteObject
DeleteDC
CreateMetaFileW
CreateDCA

shell32

SHGetUnreadMailCountW
ord16
ord4
SHGetFolderPathA
SHGetFolderPathW
ord2
SHChangeNotify
ord231
ord47

shlwapi

IntlStrEqWorkerW
UrlGetLocationA
SHOpenRegStream2A
AssocQueryStringW
ord2
PathIsSameRootW
SHQueryInfoKeyW

dbghelp

SymFromAddr
SymRegisterFunctionEntryCallback64
SymInitialize
SymCleanup
SymGetOptions
SymSetOptions
GetTimestampForLoadedLibrary
UnDecorateSymbolName
MakeSureDirectoryPathExists
ImageNtHeader
SymFindFileInPath
SymGetTypeInfo

winmm

waveOutGetNumDevs
waveOutGetErrorTextA
waveOutGetID
mmioAdvance
mixerGetNumDevs
mixerGetLineControlsA
joyGetDevCapsA
mmioClose
mmioInstallIOProcA
mmioOpenW

rpcrt4

MesEncodeFixedBufferHandleCreate
MesBufferHandleReset
MesHandleFree
MesIncrementalHandleReset
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
MesEncodeIncrementalHandleCreate
MesDecodeIncrementalHandleCreate

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list
memset
memmove
memcpy
memcmp
memchr
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_cexit
_initterm
_initialize_onexit_table
_initterm_e

api-ms-win-crt-string-l1-1-0

isspace
isxdigit
wcsncat
strncat
_wcsnicmp
wcsncpy
strncpy

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

_itoa
strtoul
_itow
_ltoa
_ultow
_ultoa
_ltow

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-stdio-l1-1-0

fwrite
ftell
fseek
fread
fopen
ferror
feof
fclose
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-time-l1-1-0

_ctime64
_time64

api-ms-win-crt-math-l1-1-0

sin
cos

Exports

Exports

_glewInit_GL_EXT_direct_state_access
extend_basic_type
ialloc
independent_calloc
tmalloc_large

Sections

.text
Size: 447KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4660817eafdc5d0e2dade29aed6a90c0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

shell32

shlwapi

dbghelp

winmm

rpcrt4

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 447KB - Virtual size: 446KB

.rdata Size: 507KB - Virtual size: 506KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 447KB - Virtual size: 446KB

.rdata
Size: 507KB - Virtual size: 506KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB