110c49c338dbdceda1d48cba5ceb47a3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

110c49c338dbdceda1d48cba5ceb47a3_JaffaCakes118
Size

260KB
MD5

110c49c338dbdceda1d48cba5ceb47a3
SHA1

0987b8733146901b50a4cb2688fdfdc5d54994fb
SHA256

219dc6696f86b46ed92055eceae5a2e9b3b33ea0bd6bc1c7126328516c01e92d
SHA512

1a459eac3e3495d87b71cb9364eaf5d807a40cafc7715dc64d0b9bf4fc862f687d1160259ea135818fc7d6a8dad0e112eda3ba6a92082c2c1c1bf84cb76f9923
SSDEEP

3072:dKTdWTd9VBe9ajlu1HdWUWr8bc1xKZJCbNkGzwVEWrnGzWJrHMkrDqVD7xiJEBSH:wTo9BeJJd/u1obCbNkwweWyqJDqNUH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
110c49c338dbdceda1d48cba5ceb47a3_JaffaCakes118

Files

110c49c338dbdceda1d48cba5ceb47a3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ef055312e45823e975181ca3b812f54d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\home\ywada\FPV\FPV53h\ExifLauncher53h_src\PTP_dll_ExifLauncher\ptp_util_usbscan\Release\ptp_util_usbscan.pdb

Imports

kernel32

SetErrorMode
GetTempPathA
CreateMutexA
MultiByteToWideChar
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetTickCount
EnterCriticalSection
GetVolumeInformationA
GetModuleFileNameA
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
lstrcmpiA
CreateEventA
DeviceIoControl
GetOverlappedResult
GetLastError
ResetEvent
WaitForMultipleObjects
ReadFile
CreateFileA
HeapSize
FlushFileBuffers
WriteFile
CloseHandle
ReleaseMutex
Sleep
SetStdHandle
SetFilePointer
GetStringTypeW
RtlUnwind
RaiseException
ExitProcess
WideCharToMultiByte
HeapFree
HeapAlloc
GetCommandLineA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetACP
GetOEMCP
GetCPInfo
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
InterlockedExchange
GetLocaleInfoA
GetStringTypeA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoUninitialize

cfgmgr32

CM_Get_DevNode_Registry_PropertyA
CM_Get_Depth
CM_Locate_DevNodeA
CM_Get_Device_ID_ListA
CM_Get_Device_ID_List_SizeA

Exports

Exports

PTP_EnumDevice
PTP_Exit
PTP_Init

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef055312e45823e975181ca3b812f54d

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

cfgmgr32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 4.0MB

.reloc Size: 188KB - Virtual size: 184KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 4.0MB

.reloc
Size: 188KB - Virtual size: 184KB