e0b314f2310b8a0fb31d269ea6d0bee4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e0b314f2310b8a0fb31d269ea6d0bee4_JaffaCakes118
Size

54KB
MD5

e0b314f2310b8a0fb31d269ea6d0bee4
SHA1

07912533ca9767ad28854cff674f0a2b21ad8037
SHA256

c9aa0f75342651d2c63c19c1ac83250e534b905a61a6acdee6c4ee56ee2500f4
SHA512

def38e1c6326935a702086fcd9354e185706ee17a3297e37125d27f7e3bf1e64bef6604a52d0e49e53b58914ac489338bb4902dd05ce3ad5a81f700b7fb65ff8
SSDEEP

1536:RhgF/Jck/7yxf/KUUnFxpNamrIY2HgHJ7fEZv:QFRcY7hUictYAgp7fWv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0b314f2310b8a0fb31d269ea6d0bee4_JaffaCakes118

Files

e0b314f2310b8a0fb31d269ea6d0bee4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

f5fa31c0418b8b456aaf2bf92a3cd146

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

rand
__getmainargs
memmove
_initterm
__p__fmode
__setusermatherr
_XcptFilter
_fpreset
_adjust_fdiv
_exit
wcslen

comctl32

ImageList_Create
InitCommonControlsEx
ImageList_Destroy
ImageList_Remove

waxmon

DllUnregisterServer

imagehlp

ImageRvaToVa
CheckSumMappedFile
BindImageEx

user32

SetCursor
IsWindow
IntersectRect
GetKeyState
LoadStringW
PostMessageW
DeferWindowPos
SendMessageW
MonitorFromWindow
BeginPaint
PtInRect
FillRect
GetDC
CreateWindowExW
GetCursorPos
RemovePropW
GetWindowTextW
GetForegroundWindow
DestroyIcon
IsWindowVisible
GetIconInfo
FindWindowExW
GetLastActivePopup
FrameRect
OffsetRect
InvalidateRect
DestroyWindow
GetSysColor
SetCapture
LoadImageW
InflateRect
wsprintfW
GetWindowTextLengthW
MapWindowPoints
CopyIcon
SetFocus
TranslateMessage
WinHelpW
CallWindowProcW
KillTimer
SetTimer
LoadCursorW
DestroyAcceleratorTable
IsRectEmpty
MonitorFromRect
RegisterClassExW
BeginDeferWindowPos

kernel32

GetStartupInfoA
lstrcmpA
GetPriorityClass
GetCurrentDirectoryA
lstrcmpiA
SetCurrentDirectoryA
SetFileAttributesA
VirtualAlloc
GetProcAddress
WriteFile
GetCurrentProcess
SetPriorityClass
GetFileAttributesA
GetCommandLineA
VirtualFree
VirtualProtectEx
WritePrivateProfileStructA
FindFirstFileA
ReadProcessMemory
InterlockedDecrement
ReadFile
GetVersion
LoadLibraryA
CreateFileA
WideCharToMultiByte
OpenProcess
SetFilePointer
GetPrivateProfileStructA
CreateSemaphoreW
GetHandleInformation
WritePrivateProfileStringA
WaitForSingleObject
VirtualQueryEx
GetFileSize
FindClose
CreateProcessA
VirtualLock
VirtualUnlock
GetCurrentProcessId
lstrlenA
VirtualAlloc
FindNextFileA

Exports

Exports

AdvInstallFile
LaunchINFSection
DoInfInstall
CreateProcessNotify
ddeslace
RegInstall
UserInstStubWrapper
DelNode
RegRestoreAll
FileSaveRestore
RebootCheckOnInstall
RegSaveRestore
ExecuteCab
AddDelBackupEntry
NeedReboot
IsNTAdmin
GetVersionFromFileEx
CloseINFEngine
RunSetupCommand
GetVersionFromFile
FileSaveMarkNotExist
TranslateInfString

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5fa31c0418b8b456aaf2bf92a3cd146

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

comctl32

waxmon

imagehlp

user32

kernel32

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 49KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 28KB

.text
Size: 49KB - Virtual size: 49KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 28KB