027142e37b27ac2a8d9111278d478d4a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

027142e37b27ac2a8d9111278d478d4a_JaffaCakes118
Size

244KB
MD5

027142e37b27ac2a8d9111278d478d4a
SHA1

a1146c3c1530481c814d774ef7afb1490c828574
SHA256

808833d6d24eec6afb51b9b43d7467e1e02d0bc1e8baea3fa9039abca228e6ac
SHA512

d4d9abe4b820ec21536b59345f4f28d53db418687edcc0b0a540574e821fd8d6fbb78601d835da3bb2738c405fcda269d36caea2c5a394113fea18aaa8be030c
SSDEEP

3072:5A6jNdVBpL3eABoMSmfUpxFLuqNshlZCTagclDoRG0fUF/sC9ARLEb:vdVB0JoCN+lZxVoR9UF/swb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
027142e37b27ac2a8d9111278d478d4a_JaffaCakes118

Files

027142e37b27ac2a8d9111278d478d4a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

60b23a14c23fd76e0d43afc3e11345d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\home\ywada\FF\FPV_MP\FPV55Sources\Comands\fc_AutoRename\Release\fc_AutoRename.pdb

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
MoveFileA
IsDBCSLeadByte
FileTimeToLocalFileTime
FlushFileBuffers
SetStdHandle
GetSystemInfo
VirtualProtect
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetFilePointer
InitializeCriticalSection
VirtualQuery
InterlockedExchange
FileTimeToSystemTime
GetDriveTypeA
FindClose
WriteFile
CloseHandle
WideCharToMultiByte
GetVersionExA
Sleep
SystemTimeToFileTime
CompareFileTime
GetLastError
GlobalAlloc
GlobalFree
GetCPInfo
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
MultiByteToWideChar
CopyFileA
SetFileAttributesA
FindFirstFileA
GetFileAttributesA
DeleteFileA
GetModuleFileNameA
RaiseException
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr

user32

InvalidateRect
DestroyWindow
UpdateWindow
GetDC
LoadImageA
GetClientRect
GetSysColorBrush
FillRect
ReleaseDC
SetCursor
KillTimer
DialogBoxParamA
EndDialog
MessageBoxA
MessageBoxW
SetDlgItemTextA
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
SendDlgItemMessageA
GetDlgItem
EnableWindow
LoadCursorA
SetTimer

gdi32

GetObjectA
CreateCompatibleDC
SelectObject
GetPixel
DeleteDC
DeleteObject
SetStretchBltMode
StretchDIBits

Exports

Exports

?CreateWindowR@@YGPAUHWND__@@PAUHINSTANCE__@@PAU1@@Z
_Close@0
_CreateWindowL@8
_CreateWindowM@8
_Exec@8
_Free@0
_GetType@0
_Init@0
_SetService@8

Sections

.text
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60b23a14c23fd76e0d43afc3e11345d7

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 110KB

.rdata Size: 52KB - Virtual size: 50KB

.data Size: 64KB - Virtual size: 70KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 112KB - Virtual size: 110KB

.rdata
Size: 52KB - Virtual size: 50KB

.data
Size: 64KB - Virtual size: 70KB

.reloc
Size: 12KB - Virtual size: 10KB