11f61797a88ff5cb7adb4ba3d55bf556_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

11f61797a88ff5cb7adb4ba3d55bf556_JaffaCakes118
Size

200KB
MD5

11f61797a88ff5cb7adb4ba3d55bf556
SHA1

efc9d4128ff1c681ec66bc7806eb6143b05c868b
SHA256

b1cf7e99dbba48328cb609b1f27519a36f9db116d40b5e17e38eb43f702b2c1d
SHA512

03390e5fac69e50086aa806052243d98bc25534d60ab3aaad0ca99414b6ffc3e8c131bab8da4959a8b6cfeeade42896df47808f1b059a66594b196a794745d25
SSDEEP

6144:QH6Rqoj+kl2KA6Cf7BX3J7FDSpnZwbmx:QWqgJ2Hv7Dm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11f61797a88ff5cb7adb4ba3d55bf556_JaffaCakes118

Files

11f61797a88ff5cb7adb4ba3d55bf556_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

e898f3818d6aeed2a2b51f3fa0a83a4a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\WorkPrg_New\Pdf3\Release\PxcComm.pdb

Imports

kernel32

GlobalFree
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
lstrcmpiA
GetModuleHandleA
GetCurrentThreadId
lstrcpynA
IsDBCSLeadByte
MulDiv
LocalFree
GlobalAlloc
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
lstrcatA
GetLocaleInfoA
GetACP
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSection
RaiseException
CreateMutexA
GetLastError
CloseHandle
Sleep
lstrlenA
OutputDebugStringA
lstrcpyA
QueryPerformanceCounter
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
ExitProcess

user32

wsprintfA
CopyRect
GetSysColor
DrawIcon
SetWindowLongA
GetClassInfoExA
LoadCursorA
FindWindowA
UnregisterClassA
FillRect
BeginPaint
GetClientRect
EndPaint
GetParent
GetFocus
IsChild
SetFocus
ShowWindow
InvalidateRect
IsWindow
GetKeyState
GetDC
ReleaseDC
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
LoadImageA
CreateWindowExA
RegisterClassExA
CharNextA
CallWindowProcA
GetWindowLongA
DefWindowProcA
DestroyWindow
DestroyIcon

gdi32

CreateDCA
GetDeviceCaps
LPtoDP
SaveDC
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateRectRgnIndirect
GetClipRgn
CreateRectRgn
SelectClipRgn
DeleteObject
CreateSolidBrush
SetMapMode

advapi32

RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHGetFileInfoA
ShellExecuteA

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
StringFromCLSID
OleRegEnumVerbs
OleRegGetUserType
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateOleAdviseHolder
OleRegGetMiscStatus

oleaut32

CreateErrorInfo
OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SetErrorInfo
VariantInit
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
VariantClear
VariantChangeType

shlwapi

PathFindExtensionA
StrCmpIW

rpcrt4

RpcStringBindingComposeA
RpcStringFreeA
RpcBindingFree
NdrClientCall
RpcMgmtIsServerListening
RpcBindingFromStringBindingA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e898f3818d6aeed2a2b51f3fa0a83a4a

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 80KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 64KB - Virtual size: 62KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 84KB - Virtual size: 80KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 64KB - Virtual size: 62KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 12KB - Virtual size: 8KB