de9dd22c8f4244a6df5a3d208d2694f2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

de9dd22c8f4244a6df5a3d208d2694f2_JaffaCakes118
Size

172KB
MD5

de9dd22c8f4244a6df5a3d208d2694f2
SHA1

d76d9d606a1927585b1c61af954ce9d0003ce7f2
SHA256

be105733c52cdedfdc23f65757a78f92ccb610f83fec785f75f4e5718ec81583
SHA512

843318cc2621587f08c37d8ec66fcda6580331ba1a7938bba09c9e697f84ff92f38464f40762240dbb22aa032cb6d9d29b151e378a1eaf36d2a32d25341f9eab
SSDEEP

3072:4fAOFihNVNMT6p8W1Ex/A9FiEez/a69bnOaClaWFhoWzmdr0POxjvjnMOp:4fUzNMT6p8W1E5Gw7bnOaIaWjoWzYAOJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de9dd22c8f4244a6df5a3d208d2694f2_JaffaCakes118

Files

de9dd22c8f4244a6df5a3d208d2694f2_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

28cabead689b7fbaabf5301255c553ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\thailand\890a\cprd32\AOL\misc\coreclient\companion\src\Alerts\Alerts.pdb

Imports

msvcp71

?_Nomemory@std@@YAXXZ

msvcr71

memset
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_initterm
_callnewh
strtoul
wcsncpy
realloc
__CxxFrameHandler
_CxxThrowException
memcpy
_resetstkoflw
_purecall
malloc
memcmp
??_V@YAXPAX@Z
??3@YAXPAX@Z
free
__security_error_handler

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA

user32

CharNextA

kernel32

LoadResource
SizeofResource
FreeLibrary
IsDBCSLeadByte
lstrcatA
GetModuleFileNameA
lstrcpyA
lstrcpynA
InterlockedDecrement
FindResourceA
DisableThreadLibraryCalls
lstrcmpiA
lstrlenA
GetLastError
LeaveCriticalSection
EnterCriticalSection
lstrlenW
WideCharToMultiByte
GetSystemTimeAsFileTime
LoadLibraryExA
GetModuleHandleA
GetTickCount
ExitProcess
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
InterlockedIncrement
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale

ole32

CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc

oleaut32

VariantInit
VariantClear
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

28cabead689b7fbaabf5301255c553ca

Headers

File Characteristics

PDB Paths

Imports

msvcp71

msvcr71

advapi32

user32

kernel32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 624B

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

.text Size: 116KB - Virtual size: 116KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 624B

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 116KB - Virtual size: 116KB