f69d18a0d0111b36ab8afe1f40b520ab_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f69d18a0d0111b36ab8afe1f40b520ab_JaffaCakes118
Size

91KB
MD5

f69d18a0d0111b36ab8afe1f40b520ab
SHA1

3dd249a82607cd55b9ad94bbc9e17904c7e2cc0d
SHA256

319e17cc1b88928f062862775bb17c032b002bb5f90185e94faef2ea4e0e4ca5
SHA512

749829426d862959c276b213951c9991c44223bcfc15c474b7fa856b64867d508bd1afdc45a209d123ae71a786a48068bc8acfe225bfd46c4f42c66f34d450b4
SSDEEP

1536:B31Q6Zu6kARUcdRbhmk3vRkGGzct0TYeF5uM2:B322kdWaSGwA5ur

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f69d18a0d0111b36ab8afe1f40b520ab_JaffaCakes118

Files

f69d18a0d0111b36ab8afe1f40b520ab_JaffaCakes118
.dll windows:5 windows x86 arch:x86

7eaa62adcb55ff77577e83322478f3c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\!!!WORK\awork\soft\soft\GAV2009\gsl3\Release\gsl.pdb

Imports

xpcom

NS_StringGetMutableData
NS_StringGetData
NS_GetServiceManager
NS_GetComponentManager
NS_Realloc
NS_CStringGetData
NS_Alloc
NS_CStringContainerFinish
NS_CStringContainerInit
NS_CStringSetData
NS_Free
NS_StringContainerInit
NS_StringContainerFinish

nspr4

PR_AtomicIncrement
PR_AtomicDecrement

kernel32

GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
WriteConsoleW
LCMapStringW
MultiByteToWideChar
LCMapStringA
RtlUnwind
CreateFileA
GetFileSize
SetEndOfFile
WriteFile
OpenProcess
ReadFile
GetLastError
CloseHandle
GetCurrentProcessId
SetFileValidData
WideCharToMultiByte
GetStringTypeA
VirtualAlloc
SetStdHandle
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

NSGetModule

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eaa62adcb55ff77577e83322478f3c0

Headers

File Characteristics

PDB Paths

Imports

xpcom

nspr4

kernel32

advapi32

psapi

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 7KB - Virtual size: 7KB