17e946c8bdc72eb1526843e0d0f7a465_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

17e946c8bdc72eb1526843e0d0f7a465_JaffaCakes118
Size

442KB
MD5

17e946c8bdc72eb1526843e0d0f7a465
SHA1

4232f609fda07de7a51791cf6e7471fdc862e675
SHA256

a6ed98ae6062617615e6e19a2a303b013a4e736812d558a6156609a876ac29da
SHA512

b936437bbe93953fdd9992a7b799dd6bd5b50be55fb4f7dad8e07e44adebe4aa95f28110d1b734c137f378cf610cc0ecdd65afb8aebd5a425b6893c91c54aa08
SSDEEP

6144:wzpUoJ/w4oUdrfVIZqgAP04yQq8ALCMsNX96NJxENKvWcJ2eoQ+Wue:wzpfJ5oIrfO8jP04LSsNaxxvWcJ2eoh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17e946c8bdc72eb1526843e0d0f7a465_JaffaCakes118

Files

17e946c8bdc72eb1526843e0d0f7a465_JaffaCakes118
.dll windows:5 windows x86 arch:x86

f76179c497c52459773abba4ff7c3fa0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\f5\trunk\SaneAd\Plugin\ResourceDll\Debug\example2.pdb

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
GetProcAddress
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
HeapValidate
IsBadReadPtr
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsDebuggerPresent
RaiseException
DebugBreak
MultiByteToWideChar
lstrlenA
LoadLibraryA
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
VirtualAlloc
WriteFile
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetProcessHeap
VirtualQuery
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
GetTimeFormatA
GetDateFormatA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringA
LCMapStringW
GetLocaleInfoW
GetTimeZoneInformation
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

infodata

Sections

.textbss
Size: - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f76179c497c52459773abba4ff7c3fa0

Headers

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.textbss Size: - Virtual size: 164KB

.text Size: 345KB - Virtual size: 344KB

.rdata Size: 67KB - Virtual size: 67KB

.data Size: 6KB - Virtual size: 14KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 15KB - Virtual size: 15KB

.textbss
Size: - Virtual size: 164KB

.text
Size: 345KB - Virtual size: 344KB

.rdata
Size: 67KB - Virtual size: 67KB

.data
Size: 6KB - Virtual size: 14KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 15KB - Virtual size: 15KB