3b6147608286520e97ac7648a44553f1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3b6147608286520e97ac7648a44553f1_JaffaCakes118
Size

71KB
MD5

3b6147608286520e97ac7648a44553f1
SHA1

eada29dab7d7ccf9fdcfb07e976566a012e1087a
SHA256

bb975eb6228e81f6ed453a07eb7d7e9ff5af9d164997022496a3fcab91ee8e29
SHA512

9c65008479a80951258cbb941fee747aa23fd7de96feecda2baefbb58deb4df62eb406e5ed1fb64f0015c1e390c5fc40a5167cb075154dabe63d8bf6a70e4e2a
SSDEEP

1536:JxYHWcHpdwOP4x84xFx/op7U6KS30xN0s/dKZsA0PdCbXl6yqg:JxYHhHpdwg47PZ273kxGK6sAxXfqg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b6147608286520e97ac7648a44553f1_JaffaCakes118

Files

3b6147608286520e97ac7648a44553f1_JaffaCakes118
.dll windows:5 windows x86 arch:x86

673350dc3c589b89e0cdab623efe3c66

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\cygwin\home\kovid\sw\build\ImageMagick-6.5.6\VisualMagick\bin\IM_MOD_RL_pwp_.pdb

Imports

core_rl_magick_

FormatMagickString
LocaleNCompare
GetFirstImageInList
DestroyString
GetExceptionMessage
EOFBlob
DestroyImage
DestroyImageInfo
RelinquishUniqueFileResource
DestroyImageList
CloseBlob
ThrowMagickException
LoadImagesTag
TellBlob
GetBlobSize
GetNextImageInList
ReadImage
ReadBlobByte
AcquireUniqueFileResource
SetImageInfoBlob
SetImageInfoProgressMonitor
CloneImageInfo
ReadBlob
OpenBlob
AcquireImage
LogMagickEvent
RegisterMagickInfo
ConstantString
SetMagickInfo
UnregisterMagickInfo

msvcr90

__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_fdopen
fputc
fclose
_errno
strerror
fwrite

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

RegisterPWPImage
UnregisterPWPImage

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

673350dc3c589b89e0cdab623efe3c66

Headers

File Characteristics

PDB Paths

Imports

core_rl_magick_

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 60KB - Virtual size: 60KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 1024B - Virtual size: 590B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 60KB - Virtual size: 60KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 1024B - Virtual size: 590B