41590c457793d851209cc6ca26df13d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41590c457793d851209cc6ca26df13d1_JaffaCakes118
Size

397KB
MD5

41590c457793d851209cc6ca26df13d1
SHA1

aecddbd973653539987a3f610ff24e180fe9d17a
SHA256

e7f3f90e68dc996a6c7ae7e766e54cea3c821e18df44cbed18e21b6b52458273
SHA512

d230e6e2cf20d74dcac0e726379e25329c92e10502ab288afcc263253558cac328dbb27a4015a021056df8a2cd8d5ebedf17b8c575f74140b9b0343094c2daa2
SSDEEP

6144:K4rVV5p84Pgzcxf8+vFUF4rVV5p84Pgzcxf8+vFU4:K4rF4AxhNUF4rF4AxhNU4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41590c457793d851209cc6ca26df13d1_JaffaCakes118

Files

41590c457793d851209cc6ca26df13d1_JaffaCakes118
.dll windows:6 windows x86 arch:x86

3d9413fbf83938c5b97e63209b966ccf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\bt\1076663\client\mail\setup\bldsetup\mail\lmcustom\objs\i386\lmcustom.pdb

Imports

kernel32

CreateEventW
InterlockedDecrement
GetModuleFileNameW
LocalAlloc
LocalFree
SetLastError
OpenMutexW
GetExitCodeProcess
CreateProcessW
GetNativeSystemInfo
MulDiv
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
EncodePointer
DecodePointer
GetLocaleInfoEx
GetCommandLineA
FlsGetValue
FlsSetValue
GetCurrentThreadId
GetCPInfo
DeleteFileW
CreateThread
ExitThread
GetProcAddress
LoadLibraryExW
CreateDirectoryW
RemoveDirectoryW
RaiseException
RtlUnwind
HeapFree
HeapAlloc
InitializeCriticalSectionAndSpinCount
LCMapStringEx
IsProcessorFeaturePresent
WaitForSingleObject
FlsAlloc
FlsFree
ExitProcess
GetModuleHandleExW
GetProcessHeap
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
IsValidLocaleName
HeapReAlloc
OutputDebugStringW
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetUserDefaultLocaleName
EnumSystemLocalesEx
SetStdHandle
WriteConsoleW
FlushFileBuffers
ResetEvent
SetEvent
GetLastError
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
CreateFileW
ExpandEnvironmentStringsW

shlwapi

PathQuoteSpacesW
UrlCreateFromPathW
PathMatchSpecW
PathRemoveArgsW
SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW
StrFormatByteSizeW
SHCopyKeyW
StrCmpW

shell32

SHChangeNotify
ord102
ShellExecuteW

msi

ord160
ord159
ord32
ord205
ord119
ord114
ord116
ord17
ord103
ord34
ord171
ord74
ord145
ord49
ord125
ord124
ord121
ord118
ord8
ord70

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleRun

oleaut32

SysAllocString
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
VariantClear
VariantInit
SysFreeString

wininet

InternetOpenW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile
InternetOpenUrlW

crypt32

CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptMsgGetParam

wintrust

WinVerifyTrust

setupapi

SetupIterateCabinetW

Exports

Exports

AddExpectedTicks
BackupFileAssociations
CheckMailRunning
EnsureOptedIn
FindRelatedProductsJr
GetAUValues
OESPADDisable
OESPADEnable
RegisterClient
RenameHotmailDefaultMailClientIfNecessary
RevertFileAssociations
SetAUValues
SetAUValuesDeferred
SetMailAsDefaultHandler
UnregisterClient

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d9413fbf83938c5b97e63209b966ccf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

shell32

msi

ole32

oleaut32

wininet

crypt32

wintrust

setupapi

Exports

Exports

Sections

.text Size: 174KB - Virtual size: 174KB

.data Size: 6KB - Virtual size: 14KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 174KB - Virtual size: 174KB

.data
Size: 6KB - Virtual size: 14KB

.reloc
Size: 16KB - Virtual size: 15KB