10ff9366fa462f89c6f90d8c1ec1e793_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

10ff9366fa462f89c6f90d8c1ec1e793_JaffaCakes118
Size

360KB
MD5

10ff9366fa462f89c6f90d8c1ec1e793
SHA1

6a94b9cd963c692b43c72e93e638e1b48681acb9
SHA256

788c5cfd4ac004c9754f96aea5365f63a40d39d061a0a987938be9fe24c00cd7
SHA512

a814fa24a35fb807f53252719c3111585e7bd3161a86e5ae70731ac4f899731e1ed44c9d2f8e69661f3cc5381eb8be71a4ceb4f423c86d6353fec4873daa655e
SSDEEP

6144:Ny9Xd+/HFi6Vnyrqw528rF5MMQa3xMEz04IMh4SUr4qrqYetV:NyH+/Fi4w528rXnQAfkSOqV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10ff9366fa462f89c6f90d8c1ec1e793_JaffaCakes118

Files

10ff9366fa462f89c6f90d8c1ec1e793_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a0e9a075347e45b8595237e45561953d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\program files\adobe\pdbs\main\bravo\BIB.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetSystemTimeAsFileTime
CloseHandle
CreateThread
GetCurrentDirectoryA
SetCurrentDirectoryA
Sleep
RtlUnwind
RaiseException
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
FatalAppExitA
TlsAlloc
SetLastError
GetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ReadFile
WriteFile
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
InterlockedExchange
VirtualQuery
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
CreateFileA
LoadLibraryA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
GetTickCount
GetCurrentProcessId
SetEndOfFile
GetTimeZoneInformation
VirtualProtect
GetSystemInfo
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

BIBGetGetProcAddress
BIBGetVersion
BIBInitialize
BIBInitialize2
BIBInitialize3
BIBInitialize4
BIBLockSmithAssertNoLocksImpl
BIBLockSmithDeleteImpl
BIBLockSmithLockImpl
BIBLockSmithUnlockImpl
BIBTerminate

Sections

.text
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0e9a075347e45b8595237e45561953d

Headers

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 112KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 192KB - Virtual size: 202KB

.rsrc Size: 4KB - Virtual size: 968B

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 116KB - Virtual size: 112KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 192KB - Virtual size: 202KB

.rsrc
Size: 4KB - Virtual size: 968B

.reloc
Size: 12KB - Virtual size: 10KB