JaffaCakes118_192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571
Size

378KB
MD5

98874c0b3a857f47f36959e10c8f67ba
SHA1

975f3d0c2d815af3174a9a97cfe1d8aab04aa5df
SHA256

192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571
SHA512

7c9d610718f676c67cd8cd5698725f458cdc1e667489b7b9a7a2f43aadb72bdc79e30bc0b0e7c6021edfcd3756d21cebedc092cd6cd264204a6b233e1ac60a56
SSDEEP

6144:pvg3f8jUwB1CwwUimghKZiMaagrK1E+eA7JeCFhi9kCUQTphHXRJN1kvjAKx3sOS:Rg3EjH3w5mgQAMaagieA7Mei9kCTFhBZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll

Files

JaffaCakes118_192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571
.zip

Password: infected
3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll
.dll windows:6 windows x86 arch:x86

dc55991f7b8a912c780d10d352635290

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\die\Oh\ease_Slip\Suffix\fall.pdb

Imports

kernel32

CreateFileW
GetWindowsDirectoryW
ReadFile
GetConsoleMode
OpenMutexW
CloseHandle
GetFileSize
DeleteCriticalSection
ReadConsoleW
VirtualProtectEx
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
EncodePointer
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapValidate
GetSystemInfo
GetCurrentThread
GetStdHandle
GetFileType
WriteFile
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
DecodePointer

uxtheme

CloseThemeData

avifil32

AVIFileGetStream
AVIFileOpenW
AVIFileExit
AVIFileInit
AVIFileEndRecord

tapi32

lineRedirectW
lineInitialize
lineHold
lineShutdown
lineTranslateAddressW

Exports

Exports

Hundredpopulate@@8
Mark@@12
Seefit@@8

Sections

.text
Size: 614KB - Virtual size: 613KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

dc55991f7b8a912c780d10d352635290

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

uxtheme

avifil32

tapi32

Exports

Exports

Sections

.text Size: 614KB - Virtual size: 613KB

.rdata Size: 181KB - Virtual size: 181KB

.data Size: 3KB - Virtual size: 123KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 614KB - Virtual size: 613KB

.rdata
Size: 181KB - Virtual size: 181KB

.data
Size: 3KB - Virtual size: 123KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 20KB - Virtual size: 20KB