b5b30928998af269bd5bccb02535bf2c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b5b30928998af269bd5bccb02535bf2c_JaffaCakes118
Size

431KB
MD5

b5b30928998af269bd5bccb02535bf2c
SHA1

d38c88fe9d81c71e25cfecdbd38501982a57d945
SHA256

893b137023ea1f230f16eba7723c246e528b8de44ac0332c52960716d7b2d401
SHA512

1e57c1e99fb27829add3a4f546d729c518b476fbee81a5bccd2811adff5131c4b62c14c71a9e4a75ffe55d64ffa59361a7c07627c81914923e8ff6cb0aaf28be
SSDEEP

12288:r66Gs9R3Pqqb85kObdjnShkqpqvKf+UCeyqrKv:ejqzHonjdE+/aa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5b30928998af269bd5bccb02535bf2c_JaffaCakes118

Files

b5b30928998af269bd5bccb02535bf2c_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mpvis.pdb

Imports

msvcrt

??2@YAPAXI@Z
realloc
free
malloc
memset
??_V@YAXPAX@Z
wcschr
_vsnwprintf
wcspbrk
??3@YAXPAX@Z
_CIacos
_finite
longjmp
_setjmp3
isdigit
isspace
_CIpow
floor
_vsnprintf
exit
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
_CIatan2
_CIsqrt
rand
time
srand
_wcsicmp
_CIcos
_CIsin
??_U@YAPAXI@Z
_purecall
memcpy

ntdll

RtlUnwind

kernel32

GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DisableThreadLibraryCalls
lstrcpynW
GetModuleFileNameW
FreeLibrary
LockResource
LoadLibraryW
lstrcatW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
WaitForSingleObject
SetEvent
VirtualFree
FlushInstructionCache
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
InterlockedExchange
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
Sleep
InterlockedCompareExchange
IsProcessorFeaturePresent
GetVersionExA
FindResourceA
LocalAlloc
RaiseException
GetProcAddress

advapi32

RegOpenKeyA
RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
TraceMessage
RegQueryValueExW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VarUI4FromStr
LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysAllocStringLen

user32

IsWindow
FillRect
GetClientRect
GetDC
GetSystemMetrics
IsRectEmpty
SetRectEmpty
CopyRect
SetCursor
PostMessageW
DefWindowProcW
SetWindowLongW
ReleaseDC
CallWindowProcW
CallNextHookEx
GetAsyncKeyState
DestroyWindow
UnhookWindowsHookEx
GetSysColor
UpdateWindow
ShowWindow
SetWindowsHookExW
IsWindowUnicode
CreateWindowExW
RegisterClassW
LoadCursorW
MonitorFromWindow
GetWindowRect
CharPrevW
CharNextW
GetWindowLongW

gdi32

StretchBlt
SetBkColor
SetTextColor
TextOutW
SetStretchBltMode
DeleteObject
SetTextAlign
GetStockObject

gdiplus

GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipCreatePen2
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipSetPathGradientCenterColor
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPointI
GdipSetPathGradientFocusScales
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipStartPathFigure
GdipAddPathEllipseI
GdipCreatePathGradientFromPath
GdipCreateFromHDC
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipDrawLineI

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ole32

oleaut32

user32

gdi32

gdiplus

winmm

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 11KB - Virtual size: 11KB

.text Size: 94KB - Virtual size: 96KB

.text
Size: 285KB - Virtual size: 285KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 94KB - Virtual size: 96KB