eb35674ac5175b41532a28e29a0df28a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eb35674ac5175b41532a28e29a0df28a_JaffaCakes118
Size

62KB
MD5

eb35674ac5175b41532a28e29a0df28a
SHA1

2c98589a46493b8393316b3ebedfba1f5e340109
SHA256

86ea89ed552578bcb3a0e2e875107aaf7e7c9f8947a1b63c76c1e353a8c56bf1
SHA512

404e3f86c93ea13f53c1d45bbb4759e685f2429a419673dd60d762517a69e0487a3cd313a6fa999f5c1a0ed7ce3d65251ce397a63725a418b380a60097e8381e
SSDEEP

768:Dq+9oiAAsRdVKmP9K/rVDKSU6C613Si1i9TqpUkNWNBNzNh2iM5kX:e+9MjjKmkVDKSZp09xkQ31VRX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb35674ac5175b41532a28e29a0df28a_JaffaCakes118

Files

eb35674ac5175b41532a28e29a0df28a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e594ed179b6156bf36dee07c5a3f7f43

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\Project\!lego2new\0101\lego_2009.09.01_2.xx\release\NSP.pdb

Imports

ws2_32

WSAEventSelect

kernel32

GetTickCount
GetProcessHeap
WriteFile
InitializeCriticalSection
WideCharToMultiByte
Sleep
SizeofResource
CreateEventA
LeaveCriticalSection
ReadFile
GetSystemDirectoryA
lstrcatA
lstrcmpW
MultiByteToWideChar
lstrlenW
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
SetEvent
GetPrivateProfileStringA
LoadLibraryA
LockResource
WaitForMultipleObjects
GetModuleFileNameA
lstrcatW
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
GetTempPathA
LocalFree
RtlUnwind
DeleteFileA
CreateThread
lstrcpyA
HeapFree
InterlockedDecrement
InterlockedIncrement
HeapAlloc
CreateProcessW
LoadResource
FreeLibrary
lstrcpynA
lstrlenA
FreeResource
SetFilePointer
lstrcmpA
FindResourceA
GetFileSize
CreateFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTempFileNameA
lstrcpyW

advapi32

RegOpenKeyExA
CryptHashData
RegCloseKey
CryptDestroyHash
RegEnumValueA
CryptCreateHash
RegDeleteValueA
CryptGetHashParam
CryptAcquireContextA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
CryptReleaseContext
RegQueryValueExA
RegSetValueExA

user32

IsCharAlphaNumericA
DispatchMessageA
CharLowerA
wsprintfA
SetTimer
GetMessageA

ole32

CoInitialize
CoCreateInstance

oleaut32

SysFreeString
VariantInit
SysAllocString
SysAllocStringLen

shlwapi

StrStrA

shell32

SHGetFolderPathA

urlmon

URLDownloadToFileW

crypt32

CryptUnprotectData

Exports

Exports

NSPStartup

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e594ed179b6156bf36dee07c5a3f7f43

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

user32

ole32

oleaut32

shlwapi

shell32

urlmon

crypt32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 47KB

.data Size: 512B - Virtual size: 912B

.CRT Size: 512B - Virtual size: 8B

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 47KB - Virtual size: 47KB

.data
Size: 512B - Virtual size: 912B

.CRT
Size: 512B - Virtual size: 8B

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 2KB - Virtual size: 2KB