af63f8e0d8c2d2aa529a10364ec7e761_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

af63f8e0d8c2d2aa529a10364ec7e761_JaffaCakes118
Size

279KB
MD5

af63f8e0d8c2d2aa529a10364ec7e761
SHA1

61187a4c2a78572f10ecf1647d49b98d4cdb76a8
SHA256

c14c82ee25d784600c35b7de2209b7951bceb7c58cc56d218d61dc2bbeee5ff8
SHA512

28ae60d215f653511f694b21bf638230a0a8cdc7840bb76fff76640bab9b6e1c660cc4104609c5b99afa2fc7c871e0cf6f45c2da3f3e808e7ad405452ed21b18
SSDEEP

6144:LLw6+mWVEoFGHjfzYNr28aj/IJ3DX67t8V:LVoFcDzZB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af63f8e0d8c2d2aa529a10364ec7e761_JaffaCakes118

Files

af63f8e0d8c2d2aa529a10364ec7e761_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a94427955fd30c186eb847630d23977a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Stage\Pali_S679.0_stage\Develop\global\bin\Release\DwfViewerExe.pdb

Imports

kernel32

GetCurrentProcess
LocalFree
HeapFree
MulDiv
LeaveCriticalSection
GlobalFree
GlobalHandle
Sleep
TerminateProcess
GetVersionExA
FreeLibrary
GetCommandLineW
InterlockedIncrement
SetEvent
InterlockedDecrement
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
FlushInstructionCache
LoadLibraryA
WideCharToMultiByte
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
LoadLibraryW
OutputDebugStringW
IsBadReadPtr
GetCurrentProcessId
GetLocalTime
WaitForSingleObjectEx
CreateMutexA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
HeapSize
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapAlloc
GetCurrentThreadId
EnterCriticalSection
SetLastError
lstrlenA
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
LoadResource
InterlockedExchange
LockResource
SizeofResource
WriteFile
CloseHandle
GetTempPathA
GetTempFileNameA
CreateThread
WaitForSingleObject
ExitProcess
RaiseException
DeleteCriticalSection
InitializeCriticalSection
GetThreadLocale
GetLocaleInfoA
GetACP
GetSystemDirectoryA

user32

DestroyWindow
GetWindow
MapDialogRect
SetWindowContextHelpId
DestroyAcceleratorTable
GetSysColor
IsChild
GetFocus
SetFocus
EndPaint
FillRect
GetClientRect
BeginPaint
IsWindow
RedrawWindow
GetParent
GetDesktopWindow
MoveWindow
GetDC
SetWindowPos
EndDialog
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
GetDlgItem
GetSystemMetrics
GetWindowPlacement
PostQuitMessage
TranslateMessage
ShowWindow
ReleaseDC

gdi32

EndDoc
GetStockObject
GetDeviceCaps
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC

winspool.drv

ClosePrinter

advapi32

RegOpenKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegCreateKeyExW
RegOpenKeyExA
RegCloseKey

ole32

OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoRevokeClassObject
CoGetClassObject

oleaut32

VariantInit
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
VarBstrCat
VarBstrCmp
SafeArrayUnlock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayCopy
SafeArrayCreate
SafeArrayDestroy
SafeArrayRedim
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysFreeString
SysStringLen
VariantChangeType

shlwapi

PathFileExistsW
PathFindExtensionW

msvcr71

exit
_cexit
_XcptFilter
_exit
_c_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
__security_error_handler
wcscpy
strlen
_mbsrchr
strcpy
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcsncpy
iswspace
wcscmp
_wcslwr
wcsstr
_purecall
_wcsicmp
wcstok
malloc
realloc
memcmp
??2@YAPAXI@Z
memmove
memcpy
_CxxThrowException
wcsrchr
wcschr
wcsspn
wcscspn
wcslen
_wtol
??_U@YAPAXI@Z
sscanf
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
??_V@YAXPAX@Z
??3@YAXPAX@Z
memset
_except_handler3
free
time
__CxxFrameHandler

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a94427955fd30c186eb847630d23977a

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

oleaut32

shlwapi

msvcr71

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 126KB - Virtual size: 128KB

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 126KB - Virtual size: 128KB