93f023a1c1b505d8b4667ea3d7d58518_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

93f023a1c1b505d8b4667ea3d7d58518_JaffaCakes118
Size

662KB
MD5

93f023a1c1b505d8b4667ea3d7d58518
SHA1

4be2c72045f66ba540ea7d9e7bd37ce42142cf6f
SHA256

d2cfb6c7709ee2c45a5bb99e894a3b1af7af7b83ec1fbddfb322120ccda36b5e
SHA512

a86e043559cdd1497a04641af3c9e0ca743c66e6ae9b8f8d03a853971c782900231792749f05ef38b9092dc0c589df84e7820924777aff8dacf152bc45c3c437
SSDEEP

12288:vkdJZqQK87eyIAhUELXaEDUwmZSN+2kNv8oe2nMYUrgPAQfM4eo8:vFwTm18oe2PyPJx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
93f023a1c1b505d8b4667ea3d7d58518_JaffaCakes118

Files

93f023a1c1b505d8b4667ea3d7d58518_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

f557e9fb9f5265548bcf5dc283c79ef2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\svn\montiera\dvlp\bin\incredibar\escortEng.pdb

Imports

psapi

GetModuleBaseNameA

kernel32

GetThreadLocale
LockResource
FindResourceW
FindResourceExW
GetCurrentProcess
CloseHandle
WaitForSingleObject
FlushInstructionCache
GetCurrentThreadId
SetLastError
CreateFileA
CreateThread
InitializeCriticalSection
GetTickCount
InterlockedExchange
lstrcmpA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA
GetDateFormatA
FileTimeToSystemTime
Sleep
ReleaseMutex
SetEvent
ResetEvent
CreateMutexA
CreateEventA
GetEnvironmentVariableA
SetEnvironmentVariableA
WriteFile
FileTimeToLocalFileTime
GetFileTime
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetFileSize
UnmapViewOfFile
ReadFile
SetFilePointer
HeapDestroy
HeapAlloc
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryA
SetThreadLocale
CompareStringW
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetTimeZoneInformation
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
GetTimeFormatA
GetCommandLineA
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
LocalFree
DecodePointer
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
GetModuleHandleW
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
RaiseException
MultiByteToWideChar
GetModuleFileNameA
CreateProcessA
lstrlenW
WideCharToMultiByte
GetLastError
HeapFree
DeleteCriticalSection
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc

user32

SetWindowLongA
CharNextA
PostMessageA
GetClassInfoExA
LoadCursorA
CreateWindowExA
RegisterClassExA
DestroyWindow
CharUpperBuffA
DefWindowProcA
GetWindowLongA
CallWindowProcA
SetWindowTextA
GetWindowRect
GetClientRect
ScreenToClient
IsWindowVisible
SetTimer
IsWindow
CharNextW
UnregisterClassA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
DispatchMessageA
FindWindowExA
EnumChildWindows
GetWindowThreadProcessId
SystemParametersInfoA
InflateRect
SetForegroundWindow
GetWindowTextLengthA
GetWindowTextA
AnimateWindow
GetCursorPos
OffsetRect
ShowWindow
RegisterWindowMessageA
SendMessageTimeoutA
GetCaretBlinkTime
CreateAcceleratorTableA
SendMessageA
GetDesktopWindow
SetFocus
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ClientToScreen
SetWindowPos
MoveWindow
GetSysColor
UpdateLayeredWindow
CharLowerBuffA
GetFocus
GetParent
GetWindow
IsChild

gdi32

CreateCompatibleBitmap
OffsetViewportOrgEx
GetStockObject
CreateSolidBrush
GetDeviceCaps
BitBlt
GetObjectA
CreateDIBSection
DeleteObject
SelectObject
DeleteDC
CreateCompatibleDC

advapi32

RegQueryValueExA
RegEnumValueW
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathW
SHGetFileInfoA

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
StringFromCLSID
OleRun
CoInitialize
CoUninitialize
CreateItemMoniker
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoGetClassObject
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
GetRunningObjectTable
CoCreateGuid

oleaut32

OleCreateFontIndirect
GetErrorInfo
DispCallFunc
SafeArrayCopy
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
VarBstrCat
VariantCopy
SysStringLen
SysFreeString
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
VarBstrCmp
SysAllocStringLen
LoadRegTypeLi
VariantInit

shlwapi

StrCmpIW
SHSetValueA
SHDeleteValueA
SHGetValueA
StrToIntExA

gdiplus

GdiplusShutdown

ws2_32

freeaddrinfo
getaddrinfo
WSASetLastError
WSACleanup
WSAStartup

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f557e9fb9f5265548bcf5dc283c79ef2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

ws2_32

Exports

Exports

Sections

.text Size: 363KB - Virtual size: 363KB

.rdata Size: 83KB - Virtual size: 83KB

.data Size: 24KB - Virtual size: 37KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 41KB - Virtual size: 41KB

.text Size: 108KB - Virtual size: 112KB

.text
Size: 363KB - Virtual size: 363KB

.rdata
Size: 83KB - Virtual size: 83KB

.data
Size: 24KB - Virtual size: 37KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 41KB - Virtual size: 41KB

.text
Size: 108KB - Virtual size: 112KB