d71684ccaa66755d46ea19a7756eb4f2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d71684ccaa66755d46ea19a7756eb4f2_JaffaCakes118
Size

310KB
MD5

d71684ccaa66755d46ea19a7756eb4f2
SHA1

73ea3eb8e16da29fbb012a5772adab11720e4706
SHA256

d595c81689373a84f0d2130644aacae451098afb6a0f447fc5109c028bfd4d8c
SHA512

c164262afc929174732449bf288df06b06ee305467d6bdf5d319c8099076b4c55a9e7b54a8a28331880cb12637df2e9627e8f31a85b0b12db9f2e95ae0656b8d
SSDEEP

6144:aeCXygiZ4/DTUYzlgcHx8P0+YEHkbQeeaQeecQeesQeeJIQeehQee/9kEUjfXQNC:ajXyp4DTUYzWHMBRkEMYXa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d71684ccaa66755d46ea19a7756eb4f2_JaffaCakes118

Files

d71684ccaa66755d46ea19a7756eb4f2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

29f3242453afc3f7b06407e86d7acacd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects Files\C++\Crysis 2 Geoning D3D Menu\Release\Crysis 2 Geoning D3D Menu.pdb

Imports

kernel32

DisableThreadLibraryCalls
ReadProcessMemory
CreateThread
GetCurrentProcess
GetVersionExA
GetProcAddress
Sleep
VirtualAlloc
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
UnmapViewOfFile
CloseHandle
CreateFileW
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
GetLastError
OutputDebugStringA
lstrcmpiA
GetFullPathNameA
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
InitializeCriticalSection
InterlockedExchange
EnterCriticalSection
VirtualFree
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
IsProcessorFeaturePresent
GetSystemInfo
VirtualProtect

user32

GetAsyncKeyState
GetSystemMetrics
SetRect

gdi32

GetCharacterPlacementA
GetCharacterPlacementW
SetBkMode
GetFontLanguageInfo
CreateFontIndirectA
GetGlyphOutlineA
CreateCompatibleDC
CreateDIBSection
SetMapMode
SelectObject
GetTextMetricsA
GetObjectW
GetTextMetricsW
ExtTextOutW
MoveToEx
CreateFontIndirectW
DeleteDC
DeleteObject
ExtTextOutA
SetTextAlign
SetBkColor
SetTextColor
GetObjectA

shell32

ShellExecuteA

msvcp90

?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?_Unlock@_Mutex@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ

msvcr90

_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
__clean_type_info_names_internal
_stricmp
_snprintf
iswspace
iswalpha
iswdigit
iswpunct
__CxxFrameHandler
strncpy
??3@YAXPAX@Z
_ftol
_finite
_CIacos
free
_vsnprintf
__CxxFrameHandler3
system
_strdate
vsprintf_s
??2@YAPAXI@Z
exit
_strtime
clock
sprintf
malloc
memset
qsort
memmove
atoi
toupper
isxdigit
_controlfp
isalnum
isdigit
tolower
atof
setlocale
_crt_debugger_hook
_strdup
isalpha
_itoa

advapi32

RegCloseKey
RegOpenKeyA
RegQueryValueExA

Sections

_TEXT
Size: 512B - Virtual size: 431B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29f3242453afc3f7b06407e86d7acacd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

msvcp90

msvcr90

advapi32

Sections

_TEXT Size: 512B - Virtual size: 431B

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 42KB - Virtual size: 53KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 21KB - Virtual size: 21KB

_TEXT
Size: 512B - Virtual size: 431B

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 42KB - Virtual size: 53KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 21KB - Virtual size: 21KB