30f1444699a248f26071e8e7016a6e65_JaffaCakes118

General

Target

30f1444699a248f26071e8e7016a6e65_JaffaCakes118
Size

204KB
MD5

30f1444699a248f26071e8e7016a6e65
SHA1

0d7d506f87da47621bbf6036a634d499ae5ccffc
SHA256

8702b47c94fa2bea858d5892ce62825db1a98f6c0c5894dc005fa7c5ac385b74
SHA512

237be64dfdb5f4667ac41359cc8d2f4cc2d04ad819df70cbb8c19e15593dafead88ddb41ad17b484cf196532c0ddd983cb7bc49e9a14949202f01f6f9ed23205
SSDEEP

3072:SS0XWZMHnplaW/arsXBy69u2MjHM/MzQpPcKVHvq:SFZlaWCQQ2AHM/dhC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30f1444699a248f26071e8e7016a6e65_JaffaCakes118

Files

30f1444699a248f26071e8e7016a6e65_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

452907e8ce5d3d8552302fac4e387b75

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

IfxCardM.pdb

Imports

ntdll

RtlUnwind

kernel32

GetEnvironmentStringsW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
GetVersionExA
HeapAlloc
RaiseException
GetLastError
HeapFree
HeapSize
OutputDebugStringA
IsBadReadPtr
ExitProcess
GetProcAddress
GetModuleHandleA
TlsAlloc
InterlockedIncrement
SetLastError
InterlockedDecrement
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
WriteFile
GetCPInfo
GetACP
GetOEMCP
InitializeCriticalSection
LoadLibraryA
IsBadCodePtr
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
VirtualQuery

winscard

SCardForgetCardTypeA
SCardTransmit
SCardSetCardTypeProviderNameA
SCardIntroduceCardTypeA

Exports

Exports

CardAcquireContext
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

452907e8ce5d3d8552302fac4e387b75

Headers

File Characteristics

PDB Paths

Imports

ntdll

kernel32

winscard

Exports

Exports

Sections

.text Size: 133KB - Virtual size: 133KB

.data Size: 60KB - Virtual size: 62KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 133KB - Virtual size: 133KB

.data
Size: 60KB - Virtual size: 62KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB