54f95b9ca999f5858cb32cf0911564ba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

54f95b9ca999f5858cb32cf0911564ba_JaffaCakes118
Size

98KB
MD5

54f95b9ca999f5858cb32cf0911564ba
SHA1

a52629dc1dd19a900035e52e13975f23395d3b51
SHA256

7079e0e6a2ce13d6d8f67e6979d12710c55390d32b0d77f698a2a9c725f00e20
SHA512

25d2bf8ff15edca8c25dfe1b617bdfef463b289c550cf8afc99d326abe876c35fc5b3207d8f7c5b3304ad0528999b4bcf2a7c4200044861318281e6456a3bded
SSDEEP

1536:q5b5TUhCeHzWtWkR0+3KiNpMy0vvzv49nikYvOA1KBYTJH2WIGFW19ANS:q59TUASuWkR9tpv6r+8Tgu4TANS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54f95b9ca999f5858cb32cf0911564ba_JaffaCakes118

Files

54f95b9ca999f5858cb32cf0911564ba_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

96dd755dc2ed07792c4f7f1789867b09

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

licmgr10.pdb

Imports

msvcrt

memset
memmove
memcpy
??_U@YAPAXI@Z
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnwprintf
wcsncmp
_wcsicmp
_wcsnicmp
bsearch
??_V@YAXPAX@Z

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocStringLen
SysStringLen

ole32

CoCreateGuid
CoTaskMemFree
CreateBindCtx
CoGetMalloc
CoCreateInstance
CoGetClassObject

user32

LoadStringA

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExW
RegOpenKeyExW

kernel32

CreateFileW
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
FindResourceExW
LoadResource
SetLastError
GetLocaleInfoW
GetVersionExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
SetEndOfFile
UnmapViewOfFile
WriteFile
ReadFile
GetFileSize
WideCharToMultiByte
CreateFileA
CloseHandle
CompareStringA
TlsAlloc
GetProcessHeap
GetCurrentThreadId
TlsFree
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
GetVersionExA
GetModuleFileNameA
TlsGetValue
LoadLibraryA
GetProcAddress
FreeLibrary
lstrlenA
GetLastError
HeapFree
HeapAlloc
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
FindResourceW
SearchPathW
SetFilePointer
MultiByteToWideChar

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96dd755dc2ed07792c4f7f1789867b09

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

ole32

user32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 34KB

.data Size: 57KB - Virtual size: 57KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 35KB - Virtual size: 34KB

.data
Size: 57KB - Virtual size: 57KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB