d182337b33a18b3a44eb0361180bf732_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d182337b33a18b3a44eb0361180bf732_JaffaCakes118
Size

19KB
MD5

d182337b33a18b3a44eb0361180bf732
SHA1

bbcc45799d9fbf108c992fab55e0c7881201ebc1
SHA256

0f9f152d50b6b1c714a50d73b63b94b7675c3f304d3e6ecda5e7baaa8466ba0b
SHA512

78c97a4db22e1a14c7c8d2d5de5bca26c858a3544a4f614374ea9dde3bd99fd388a941d4ba526701ebfc5d43fc134302a9bd98eb6bb119649abafc48af46b8d7
SSDEEP

384:pBUR5px8771777J95YeaAMb8TTwQo5LHk564ZO+Su9p/hItf:pBUpeYeuLF4tzgf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d182337b33a18b3a44eb0361180bf732_JaffaCakes118

Files

d182337b33a18b3a44eb0361180bf732_JaffaCakes118
.dll windows:5 windows x86 arch:x86

84d81cb9234e9439a65436f032f56dfc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\OOO330\ooo\bridges\wntmsci12.pro\bin\rmcxt3.pdb

Imports

msvcr90

_except_handler4_common
_onexit
_crt_debugger_hook
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??2@YAPAXI@Z
memset
_CxxThrowException
??3@YAXPAX@Z
__CxxFrameHandler3

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange

sal3

osl_createMutex
osl_destroyMutex
osl_acquireMutex
osl_releaseMutex
osl_getGlobalMutex
osl_decrementInterlockedCount
rtl_uString_assign
rtl_ustr_hashCode_WithLength
osl_incrementInterlockedCount
rtl_ustr_compare_WithLength
rtl_uString_release
rtl_uString_acquire

stlport_vc7145

?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z
??1?$allocator@PAX@_STL@@QAE@XZ
??1?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@XZ
?swap@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXAAV12@@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@IABQAXABV?$allocator@PAX@1@@Z
?get_allocator@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QBE?AV?$allocator@PAX@2@XZ
?_M_fill_insert@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXPAPAXIABQAX@Z
?reserve@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXI@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@ABV?$allocator@PAX@1@@Z

Exports

Exports

GetVersionInfo
remote_addContextListener
remote_createContext
remote_getContext
remote_getContextList
remote_removeContextListener

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 842B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

84d81cb9234e9439a65436f032f56dfc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr90

kernel32

sal3

stlport_vc7145

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 920B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 842B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 920B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 842B