d302abec41186b33c56ed7156730c75c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d302abec41186b33c56ed7156730c75c_JaffaCakes118
Size

19KB
MD5

d302abec41186b33c56ed7156730c75c
SHA1

126dc2e776f049fdb28850e247cecb6a6d3b30b3
SHA256

4b206828642a12b2da8c24a59ed4d77bafee6c296a353893c49f4f472f4b2eac
SHA512

db9d244717503519466fe42efdbd874d41578bd4bbfcdbeae8591adb563649d2d9a1d45fa4e05f3b348cbf66995d542f1f054006fe938b0ee05a0b0d06852c11
SSDEEP

384:pBUR5px8771777J95YeaAMb8TTwQo5LHk564ZO+Su9p/hItf:pBUpeYeuLF4tzgf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d302abec41186b33c56ed7156730c75c_JaffaCakes118

Files

d302abec41186b33c56ed7156730c75c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

84d81cb9234e9439a65436f032f56dfc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\OOO330\ooo\bridges\wntmsci12.pro\bin\rmcxt3.pdb

Imports

msvcr90

_except_handler4_common
_onexit
_crt_debugger_hook
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??2@YAPAXI@Z
memset
_CxxThrowException
??3@YAXPAX@Z
__CxxFrameHandler3

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange

sal3

osl_createMutex
osl_destroyMutex
osl_acquireMutex
osl_releaseMutex
osl_getGlobalMutex
osl_decrementInterlockedCount
rtl_uString_assign
rtl_ustr_hashCode_WithLength
osl_incrementInterlockedCount
rtl_ustr_compare_WithLength
rtl_uString_release
rtl_uString_acquire

stlport_vc7145

?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z
??1?$allocator@PAX@_STL@@QAE@XZ
??1?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@XZ
?swap@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXAAV12@@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@IABQAXABV?$allocator@PAX@1@@Z
?get_allocator@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QBE?AV?$allocator@PAX@2@XZ
?_M_fill_insert@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXPAPAXIABQAX@Z
?reserve@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXI@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@ABV?$allocator@PAX@1@@Z

Exports

Exports

GetVersionInfo
remote_addContextListener
remote_createContext
remote_getContext
remote_getContextList
remote_removeContextListener

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 842B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

84d81cb9234e9439a65436f032f56dfc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr90

kernel32

sal3

stlport_vc7145

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 920B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 842B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 920B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 842B