bf5ccd1d790798d0ca032dd4679f3b6c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

bf5ccd1d790798d0ca032dd4679f3b6c_JaffaCakes118
Size

443KB
MD5

bf5ccd1d790798d0ca032dd4679f3b6c
SHA1

72da81141d16d09b4baf19d8d30f0e406e4b8d6a
SHA256

dbc974edf66cf5689132154fcb3845df8cd89aa2f238086ee716cbcf4eb3cb5b
SHA512

2c0b141fd6518883a681a2bb52b8b0fce8a9abb106730ba36e68f8954af3cbf756ff36ac448dd8af38330f34cf6efbdf4edb34efc8ce9588ffe188be5bbe8aa6
SSDEEP

12288:KQOQLWQ7NJuL5rBl1VSvXAPXENg15OM0uzdqQHBVKhjOxbjg:1OEWQ7yjnVVyupqQHLKhjOB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf5ccd1d790798d0ca032dd4679f3b6c_JaffaCakes118

Files

bf5ccd1d790798d0ca032dd4679f3b6c_JaffaCakes118
.dll windows:6 windows x86 arch:x86

dd168ee082a8d679cdcc31c4a755494c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Search\48\that\bright\4\Heat\Sent\think\Division\Follow\Buy\protect\rope.pdb

Imports

advapi32

OpenProcessToken
OpenThreadToken
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ControlService
CreateServiceW
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
SetEntriesInAclA

kernel32

GetDateFormatA
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnumSystemLocalesW
GetVersionExA
CreateFileA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetTempPathA
GetModuleHandleA
GetSystemTime
SizeofResource
LoadResource
Sleep
OpenProcess
VirtualProtectEx
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
ReadFile
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
GetACP
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
OutputDebugStringW
CreateThread
IsValidLocale
GetUserDefaultLCID
SetEndOfFile

user32

FindWindowA
EnumChildWindows
MapWindowPoints
GetWindowTextA
ValidateRect
InvalidateRect
BeginPaint
GetClassNameA
UpdateWindow
DestroyMenu
GetSystemMetrics
GetAsyncKeyState
OpenClipboard
SetWindowPos
PostMessageA
GetMessagePos
GetDC

comctl32

ImageList_GetImageCount
ImageList_GetBkColor
ImageList_EndDrag
ImageList_GetDragImage
ImageList_Create

imm32

ImmGetCompositionStringA
ImmSetCompositionFontA
ImmNotifyIME
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

Exports

Exports

Inch5
Onceperiod
Settwenty

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd168ee082a8d679cdcc31c4a755494c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

comctl32

imm32

Exports

Exports

Sections

.text Size: 313KB - Virtual size: 312KB

.rdata Size: 75KB - Virtual size: 75KB

.data Size: 6KB - Virtual size: 5.0MB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 313KB - Virtual size: 312KB

.rdata
Size: 75KB - Virtual size: 75KB

.data
Size: 6KB - Virtual size: 5.0MB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 12KB - Virtual size: 11KB