d6ca810f6c2fd4a93041faa66d1836de_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d6ca810f6c2fd4a93041faa66d1836de_JaffaCakes118
Size

192KB
MD5

d6ca810f6c2fd4a93041faa66d1836de
SHA1

e5e55a24b4dfc7c0aed129f5f58cdf05fb48a95e
SHA256

d582933cdf5d7027d9f8d4feb0c3abe603269bf9669058048c2048f77e7ec108
SHA512

c9f10ec9b1b9503abe2aa177675007599fd5b6e63555ae35cc0abb3120e20d3d8876b730ec731fae0d3ee8ace57d30520e14a946e56bb3cb86e97a9c4ece721d
SSDEEP

3072:JYnCRK9E65BDDvYYOCuV2z25QLiPHVmTe8+Uu2junrezto4KtU:JYniK9E0ezCEG2+LcH0p+Uu2inCpozt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6ca810f6c2fd4a93041faa66d1836de_JaffaCakes118

Files

d6ca810f6c2fd4a93041faa66d1836de_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6110c9659591164884c6d72293ad5ffa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThread
SetThreadPriority
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceA
GetLastError
LocalFree
FormatMessageA
GetHandleInformation
GetStdHandle
CreateFileA
DeviceIoControl
CloseHandle
GetModuleHandleA
GetWindowsDirectoryA
GetVersionExA
DeleteFileA
ExitProcess
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
GetFileType
GetCurrentThreadId
GetCommandLineA
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStartupInfoA
GetProcAddress
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
SetLastError
RtlUnwind
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
InterlockedExchange
VirtualQuery
LoadLibraryA
FlushFileBuffers
GetACP
GetOEMCP
GetCPInfo
SetFilePointer
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo

user32

wsprintfA

advapi32

StartServiceA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
CreateServiceA

Exports

Exports

FOPNL_BlockFile
FOPNL_BlockFileByName
FOPNL_Connect
FOPNL_ControlChangedList
FOPNL_ConvertFileName
FOPNL_Disconnect
FOPNL_ExtractRes
FOPNL_FreeMemory
FOPNL_GetNotification
FOPNL_GetRecentList
FOPNL_SetLMAgainFlag
FOPNL_Test
FOPNL_UnblockFile
FOPNL_UnlockFile
FOPNL_UnlockLM
_Install@16
_Uninstall@16

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6110c9659591164884c6d72293ad5ffa

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 136KB - Virtual size: 133KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 136KB - Virtual size: 133KB

.reloc
Size: 8KB - Virtual size: 4KB