f5c3d57c77625fc4addddbf82943e80c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f5c3d57c77625fc4addddbf82943e80c_JaffaCakes118
Size

383KB
MD5

f5c3d57c77625fc4addddbf82943e80c
SHA1

b4507db73c53ddb2666a488e0041fc55c3821c99
SHA256

15b89fa4ac0b095a6bd18200aff73006ffcad9f2b2fb212addc30297e51fed75
SHA512

ab85afc2c18446df65dd16e10badd1a23cc88567d21079c503eff0d91f10c03fa6446b0f3e292e0f520523d8c0966bfecccb5b7326c8dfededf43de176fdf5ae
SSDEEP

6144:7JyX2AjK6AdyaCgszcKFgC2qLaeNAxFUgEdHjWViqZ8YEaQrluF5PVHaKzeD7/8P:LSOa1zcKFKIOUuVi0HQG6yeD7UP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5c3d57c77625fc4addddbf82943e80c_JaffaCakes118

Files

f5c3d57c77625fc4addddbf82943e80c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

08b36769c96a79d89161d3faf580a8e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

atmlib

ATMFontStatusA
ATMGetBuildStr
ATMGetBuildStrW
ATMBBoxBaseXYShowTextW
ATMSelectObject
ATMAddFontExW
ATMEnumMMFontsW
ATMAddFontW
ATMEnumMMFonts
ATMGetGlyphListW
ATMGetFontInfoW
ATMEnumFontsW
ATMGetNtmFields
ATMMakePFMW
ATMGetFontPathsA
ATMRemoveSubstFontA
ATMGetFontInfo
ATMGetFontBBox
ATMFontStatusW
ATMXYShowTextA
ATMClient
ATMAddFontEx
ATMRemoveFontW
ATMEnumFontsA
ATMAddFontExA
ATMGetPostScriptName
ATMGetVersionEx
ATMGetOutlineW
ATMBBoxBaseXYShowTextA
ATMGetGlyphListA
ATMEnumFonts
ATMMakePSSA
ATMXYShowText
ATMXYShowTextW
ATMGetFontPaths

glu32

gluOrtho2D
gluPartialDisk
gluBuild1DMipmaps
gluEndSurface
gluEndCurve
gluTessProperty
gluTessVertex
gluScaleImage
gluPerspective
gluTessNormal
gluUnProject
gluDeleteQuadric
gluBuild2DMipmaps
gluEndTrim
gluNewNurbsRenderer
gluErrorUnicodeStringEXT
gluPwlCurve
gluQuadricOrientation
gluBeginTrim
gluNurbsSurface
gluLookAt
gluBeginSurface
gluGetTessProperty
gluNurbsProperty
gluTessBeginPolygon
gluCylinder
gluTessEndPolygon
gluTessEndContour
gluTessCallback
gluGetNurbsProperty
gluNurbsCurve
gluNewQuadric
gluLoadSamplingMatrices
gluProject
gluQuadricTexture
gluQuadricNormals
gluSphere
gluBeginCurve
gluNurbsCallback
gluDisk
gluNextContour
gluPickMatrix
gluNewTess

dbnetlib

ConnectionClose
ConnectionTransact
ConnectionErrorW
ConnectionOpenW
InitSession
ConnectionGetSvrUser
ConnectionError
ConnectionServerEnum
ConnectionMode
GenClientContext
ConnectionVer
ConnectionStatus
ConnectionOpen
ConnectionServerEnumW
ConnectionRead
InitEnumServers
GetNextEnumeration
ConnectionSqlVer
InitSSPIPackage
ConnectionWriteOOB
ConnectionObjectSize
TermSSPIPackage
ConnectionCheckForData
ConnectionFlushCache
ConnectionWrite
ConnectionOption
TermSession
CloseEnumServers

kernel32

GetConsoleSelectionInfo
FlushFileBuffers
LoadLibraryA
GetDateFormatA
SetThreadPriorityBoost
GetConsoleFontInfo
CreateWaitableTimerA
PurgeComm
GetPrivateProfileStringW
VirtualAlloc
SetMailslotInfo
CancelWaitableTimer
CreateTimerQueueTimer
GetSystemDefaultLangID
GetLocaleInfoW
UnhandledExceptionFilter
GetTickCount
TzSpecificLocalTimeToSystemTime
UnregisterWaitEx
SetVolumeLabelA
ReadConsoleOutputCharacterA
GetGeoInfoA
GlobalDeleteAtom
GetProcessWorkingSetSize
GetConsoleMode
SetEndOfFile
WriteFileGather
GetGeoInfoW
OutputDebugStringA
SetTapeParameters
EnumDateFormatsExA
SetConsoleCursorMode
SetConsoleScreenBufferSize
EnumDateFormatsExW

dbghelp

SymGetSymPrev
MakeSureDirectoryPathExists
ImageDirectoryEntryToDataEx
SymGetLineFromAddr64
FindDebugInfoFileEx
UnDecorateSymbolName
SymCleanup
vc7fpo
SymGetTypeInfo
ImageDirectoryEntryToData
FindDebugInfoFile
ExtensionApiVersion
FindFileInSearchPath
WinDbgExtensionDllInit
SymGetModuleBase64
DbgHelpCreateUserDumpW
SymMatchFileName
ImagehlpApiVersion
SymUnloadModule
EnumerateLoadedModules
SymGetOptions
SymFindFileInPath
SymEnumerateModules
SymGetLineFromAddr
srcfiles
SymMatchString
dh
lmi
SymGetSymFromName64
SymEnumTypes
SymFunctionTableAccess64
SymGetModuleInfo64
SymGetLinePrev64
SymLoadModule64
SymEnumSym
FindFileInPath
FindExecutableImage
dbghelp

msvcrt

_wexeclp
__CxxFrameHandler
_fpreset
_unlock
bsearch
__p__mbctype
strspn
free
getc
_except_handler3
_open_osfhandle
_strnicoll
_mbspbrk
_vsnprintf
ungetwc
_wctime
_wcsnicmp
strncmp
__getmainargs
_scwprintf
_time64
__p__commode
_wsetlocale
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
tmpfile
_aligned_free
putc
_wtol
_chdrive
_ismbcl1
_adj_fdivr_m64
_cwprintf
__p___mb_cur_max
_wcsrev
wcscpy
__set_app_type
vwprintf
exit
_mbctokata
__p__winminor

keymgr

PRShowSaveFromMsginaW
PRShowRestoreFromMsginaW
CPlApplet
PRShowSaveWizardExW
DllMain
PRShowRestoreWizardW
KRShowKeyMgr
PRShowRestoreWizardExW

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08b36769c96a79d89161d3faf580a8e7

Headers

DLL Characteristics

File Characteristics

Imports

atmlib

glu32

dbnetlib

kernel32

dbghelp

msvcrt

keymgr

Sections

.text Size: 155KB - Virtual size: 155KB

.rdata Size: 141KB - Virtual size: 141KB

.data Size: 79KB - Virtual size: 543KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 155KB - Virtual size: 155KB

.rdata
Size: 141KB - Virtual size: 141KB

.data
Size: 79KB - Virtual size: 543KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 1024B