c0e7b69c1506983b9df3ac347c4a3df0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c0e7b69c1506983b9df3ac347c4a3df0_JaffaCakes118
Size

213KB
MD5

c0e7b69c1506983b9df3ac347c4a3df0
SHA1

3f26249a4e218907a6f6632a04ba869a4d3e9e07
SHA256

02fcd58ff3203f3a57bd8822123e86a00abe89206a062238c423f9c86e26bc0d
SHA512

cb347643a2a20186b5b8206d61d67b3eac79ffb008dc456d97ea062d7f73c0238133ad13b7eca7d5770a0d169c3ff5884857b30f27d406bf47ff5281ee5f5786
SSDEEP

3072:xB6UP5d+RhTGzQY0MzO1YC9a+O6IoYOTRI035HTXyEfocZU:xB6UxQTTGpO1z966XNrU5x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0e7b69c1506983b9df3ac347c4a3df0_JaffaCakes118

Files

c0e7b69c1506983b9df3ac347c4a3df0_JaffaCakes118
.dll windows:5 windows x86 arch:x86

59fd9d395597c1c89d7af3a0ea0eb46c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\rpimageplayer\rel32\rpimageplayer.pdb

Imports

user32

EndPaint
BeginPaint
GetWindowRect
GetSystemMetrics
CharNextA
CharPrevA
SetWindowLongA
CallWindowProcA
ReleaseDC
GetDC

gdiplus

GdipLoadImageFromFile
GdipCreateSolidFill
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetImagePixelFormat
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateFromHWND
GdipFillRectangle
GdipDrawImageRect
GdipCloneBrush
GdipCloneImage
GdipDisposeImage

msvcr90

_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
isspace
_strdup
strtok
_time32
atof
toupper
_stricmp
_strnicmp
printf
strnlen
_gmtime32
vsprintf
asctime
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
atoi
memmove_s
memcpy_s
memmove
_vsnprintf
sprintf
memcpy
atol
_ismbcspace
realloc
free
malloc
strncpy
_ismbblead
strncmp
strstr
strrchr
strchr
memset
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_putenv
__clean_type_info_names_internal

kernel32

MoveFileA
CreateFileA
SetFilePointer
WaitForSingleObject
CloseHandle
DeleteFileA
CreateDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
SetErrorMode
LoadLibraryA
GetProcAddress
FreeLibrary
SetCurrentDirectoryA
GetModuleHandleA
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentDirectoryA
IsBadWritePtr
VirtualProtect
IsBadReadPtr
TerminateThread
CreateThread
WriteFile
GetThreadContext
VirtualQuery
OpenProcess
GlobalMemoryStatus
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
FindResourceExA
Sleep
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
lstrlenA
RaiseException
WideCharToMultiByte
GetCurrentProcessId
GetEnvironmentVariableA
GetModuleFileNameA
InterlockedExchange
EnterCriticalSection
InterlockedCompareExchange
TerminateProcess

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

gdi32

GetDeviceCaps

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

SHGetFolderPathA

shlwapi

PathAddBackslashA
PathAppendA

version

VerQueryValueA
GetFileVersionInfoA

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59fd9d395597c1c89d7af3a0ea0eb46c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

gdiplus

msvcr90

kernel32

msvcp90

gdi32

advapi32

shell32

shlwapi

version

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 101KB - Virtual size: 100KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 101KB - Virtual size: 100KB

.reloc
Size: 11KB - Virtual size: 11KB