f0d761c70bbcd338489d4f59e4f007d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f0d761c70bbcd338489d4f59e4f007d4_JaffaCakes118
Size

411KB
MD5

f0d761c70bbcd338489d4f59e4f007d4
SHA1

93f1e6b1bae3ff63c4a7bd8d4a6d039950cac091
SHA256

8b0b0cc07c4f14ad9064b72f74fd8b26e176e8766f0a8fc955beb03725f2056a
SHA512

82fec5373c5d0da1061f7439f237a7c54f043e652dfb009598739d01597b096688f66446c0e74da908af668a322bb7196085cc981098d33e733d3eecb984d96c
SSDEEP

12288:Hh0wttT7kMppveOMNAzsCNwG0K1BDzF8EBaYHTH:ECqGl1BPF8EBaYHT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0d761c70bbcd338489d4f59e4f007d4_JaffaCakes118

Files

f0d761c70bbcd338489d4f59e4f007d4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

bf610aac3d929a31f9553895f24616a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\build\source\videoeditor\rel32\videoeditor.pdb

Imports

ole32

CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance

user32

CharNextA
PostMessageA
GetClientRect
GetDC
ReleaseDC
SetWindowLongA
DefWindowProcA
CallWindowProcA
EndPaint
BeginPaint
GetUpdateRgn
GetMessageTime
GetMessagePos
GetWindowLongA
GetCursorPos
ReleaseCapture
SetCapture
CharUpperA
CharLowerA
GetSystemMetrics
CharPrevA
ClientToScreen
GetWindowRect
wsprintfA
GetWindowThreadProcessId
SystemParametersInfoA
IsIconic
PostQuitMessage
DispatchMessageA
TranslateMessage
PeekMessageA
ShowWindow
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
FlashWindow

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

gdi32

BitBlt
CreateCompatibleBitmap
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBitmap
DeleteObject
GetDIBits
GetObjectA

gdiplus

GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipAddPathLine2
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipDrawString
GdipDrawImageI
GdipCloneBrush
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetDC
GdipReleaseDC
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP

kernel32

GetFileSize
DeleteFileA
GetVersionExA
GetDiskFreeSpaceA
LoadLibraryA
FreeLibrary
WaitForMultipleObjects
GetLocaleInfoA
FindClose
HeapAlloc
HeapFree
SetThreadPriority
GlobalLock
GlobalUnlock
SetEnvironmentVariableA
CreateEventA
SetEvent
CreateFileA
GetFileSizeEx
SetFilePointer
ReadFile
WaitForSingleObject
FindNextFileA
FindFirstFileA
GetFileAttributesA
GetTickCount
GetCurrentProcessId
GetEnvironmentVariableA
GetCurrentThreadId
GlobalFree
GlobalAlloc
InterlockedExchange
InterlockedCompareExchange
CloseHandle
ResetEvent
IsDBCSLeadByte
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetErrorMode
GetSystemInfo
GetVersion
GlobalSize
GetLocaleInfoW
CreateProcessA
Sleep
ReleaseMutex
CreateMutexA
GetSystemDirectoryA
HeapDestroy
HeapReAlloc
HeapSize
GetProcessHeap
lstrlenW
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
MultiByteToWideChar
lstrlenA
GetModuleHandleA
GetProcAddress
GetLastError
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
RaiseException

shell32

SHGetFolderPathA
ShellExecuteA
SHGetFileInfoA

oleaut32

SysStringLen
VariantInit
VariantClear
SysAllocString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
GetErrorInfo
VariantCopy
VariantChangeType
SysFreeString

shlwapi

PathCreateFromUrlA
PathCombineA

msvcr90

strtol
_stricmp
ferror
fflush
exit
fprintf
__iob_func
_vscwprintf
vswprintf_s
fscanf
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
sprintf
_vsnprintf
getenv
_stat32
strchr
strrchr
strstr
_ismbblead
strncpy
_access
wcsnlen
_strnicmp
_putenv
printf
sscanf
realloc
strnlen
_beginthreadex
memmove_s
atol
memcpy
fopen
fwrite
fclose
fseek
fread
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
??_V@YAXPAX@Z
malloc
free
memcpy_s
strcpy_s
strncpy_s
??2@YAPAXI@Z
??_U@YAPAXI@Z
_wcsicmp
_resetstkoflw
_purecall
_recalloc
calloc
memset
??8type_info@@QBE_NABV0@@Z

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf610aac3d929a31f9553895f24616a4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

user32

advapi32

version

gdi32

gdiplus

kernel32

shell32

oleaut32

shlwapi

msvcr90

msvcp90

Exports

Exports

Sections

.text Size: 211KB - Virtual size: 211KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 14KB

.rsrc Size: 104KB - Virtual size: 103KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 211KB - Virtual size: 211KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 14KB

.rsrc
Size: 104KB - Virtual size: 103KB

.reloc
Size: 30KB - Virtual size: 30KB