0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118
Size

84KB
MD5

0e22fc8b9d0bc920d52607285c2e8f88
SHA1

daf6b1b9ecc1f66e7e5d570976199b5c13603fae
SHA256

79b45a9a12051c40af3c52e983d99b30c6c5840a77d482edeb89597cef54f7f8
SHA512

3da29269acd78bbfc6438593ddf5a826650b70c6dedc81d2588dc748824a444fca346e2a3f9f645e9c88b74000ef0b8bf18a15c4f09cd6feec9e17deb7f17d03
SSDEEP

1536:7CWpkA6f98Pjs5JInCMh5Qh5l7EOTfksu9d1Z9YBiDQwciOGdug:mWpkAu98rswnCM4hj5uH1Z9YBcQRiOGk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118

Files

0e22fc8b9d0bc920d52607285c2e8f88_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

395888ea0feec6b76ba62caca79c79ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\im_client\source\thunk\src\Http\HttpPlugin\Product Release\HttpPlugin.pdb

Imports

kernel32

DeleteCriticalSection
GetLastError
lstrcmpiW
lstrcpynW
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
InitializeCriticalSection
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
lstrcatW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
RaiseException
lstrcpyW
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
SizeofResource
InterlockedExchange
GetTickCount
QueryPerformanceCounter
ExitProcess
GetVersionExA

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
RegisterTypeLi
VarUI4FromStr
SysFreeString
LoadTypeLi
UnRegisterTypeLi

shlwapi

PathFindExtensionW

msvcp71

?_Nomemory@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

msvcr71

strncmp
_itoa
__CppXcptFilter
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
??3@YAXPAX@Z
__CxxFrameHandler
malloc
free
_CxxThrowException
_except_handler3
??_V@YAXPAX@Z
_purecall
realloc
memmove
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
strchr
strstr
_stricmp
wcsncpy
atoi
memset
_callnewh

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

395888ea0feec6b76ba62caca79c79ee

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 504B

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 504B

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 5KB