f5a839f8acd2525938fc8ad6edc1a2f0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f5a839f8acd2525938fc8ad6edc1a2f0_JaffaCakes118
Size

12KB
MD5

f5a839f8acd2525938fc8ad6edc1a2f0
SHA1

06a08267daab122ae736ca232be3e106ed4960d7
SHA256

3eed1f8279b195b273f885cfd11e37c018011752dc43d9371106f0b3172e8a1e
SHA512

6e0b7a763aa694c92c8d0997ff3eaf2f08980ec92ea463bbf8a70faaace1e77f538e565b20cdc956de96ab7f9fb475bd33160723b6d1b0c685051e756abec6a1
SSDEEP

192:QdGc96bcs1qhxgaBOYY2WTqA+T3sg9eAO5MmFrqwgQ2D3X+8qZpFYoSZRf:QdGc9wcsY6BYYxTqNT99lO5MIqxuTM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5a839f8acd2525938fc8ad6edc1a2f0_JaffaCakes118

Files

f5a839f8acd2525938fc8ad6edc1a2f0_JaffaCakes118
.dll windows:5 windows x86 arch:x86

47976f08801930f3423f09793ed72af0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Meus documentos\Visual Studio 2008\Projects\GunzExp\Release\GunzExp.pdb

Imports

kernel32

GetCurrentProcess
Sleep
FlushInstructionCache
DisableThreadLibraryCalls
VirtualProtect
CreateThread
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId

user32

GetAsyncKeyState

msvcp90

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

msvcr90

_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
_amsg_exit
_lock
_onexit
_except_handler4_common
_malloc_crt
_encode_pointer
vsprintf_s
free
_initterm
_decode_pointer
__dllonexit
_encoded_null
memcpy
_initterm_e
__CxxFrameHandler3

Exports

Exports

_DllMain@12

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 906B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47976f08801930f3423f09793ed72af0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 988B

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 1024B - Virtual size: 906B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 988B

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 1024B - Virtual size: 906B