JaffaCakes118_67754448629b74dcc12bd39bfe0bf9e0

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_67754448629b74dcc12bd39bfe0bf9e0
Size

159KB
MD5

67754448629b74dcc12bd39bfe0bf9e0
SHA1

33536f3ec0f4acc0f87919885c61c39b61a17eac
SHA256

63c34103cf06e36d3ed44c016a51ac6954da3b4109c7420a8642b4b7b83aa6b7
SHA512

3309e17557efabc87855b4c4c9f800d6575cc5e8e1e5b4c9116a1a45e093b81668ec90c9c498bca75127320281386ac15f7354fc4c96e7275904c0f15440381d
SSDEEP

3072:HRccpvUG4OmCnxYWI5SEsjCkoxNSzQF9eBKrYMCLuwqHFDj0:yYU7cJcZZNIovVHFv0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_67754448629b74dcc12bd39bfe0bf9e0

Files

JaffaCakes118_67754448629b74dcc12bd39bfe0bf9e0
.dll windows:4 windows x86 arch:x86

4a8471176721c0667754c7ab16216f74

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\cm\build\public\TkbkWinCln_P5M1B1A.06-10-26\talkback\build\client\vs2003\Release\talkback\tbdiag.pdb

Imports

msvcrt

_adjust_fdiv
_initterm
memmove
memcmp
strcmp
free
malloc
strlen
_strnicmp
rename
_mbsrchr
sprintf
strncpy
_except_handler3
_vsnprintf
time
srand
rand
memchr
memset
memcpy
strrchr
strcpy
strcat
__CxxFrameHandler

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

kernel32

CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenMutexA
GlobalMemoryStatus
QueryPerformanceFrequency
QueryPerformanceCounter
lstrlenA
CreateMutexA
ReleaseMutex
VirtualAlloc
CreateProcessA
CreateDirectoryA
ExitProcess
lstrcmpiA
IsBadStringPtrA
GetFileAttributesA
GetModuleFileNameA
IsBadReadPtr
GetProcAddress
WriteProcessMemory
GetCurrentProcess
VirtualProtect
VirtualQuery
GetSystemInfo
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetModuleHandleA
GetVersion
GetCommandLineA
VirtualFree
CloseHandle
GetCurrentProcessId
SetUnhandledExceptionFilter
IsBadCodePtr
WaitForSingleObject
CreateThread
DuplicateHandle
GetCurrentThreadId
SetErrorMode
LoadLibraryA
FreeLibrary
TlsAlloc
ReadFile
SetFilePointer
CreateFileA
TlsSetValue
TlsGetValue
Sleep
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
IsBadWritePtr
DeleteFileA
SetEndOfFile
GetFileSize
GetTempFileNameA
GetVersionExA
GetThreadContext
GetLastError
TlsFree
GetTickCount
MoveFileA
GetLongPathNameA
OpenProcess
WideCharToMultiByte
InterlockedExchange
TerminateThread
ReleaseSemaphore
TerminateProcess
CreateSemaphoreA
WriteFile
FindClose
FindFirstFileA
FindNextFileA
CopyFileA
ExpandEnvironmentStringsA

user32

LoadStringA
EnumWindows
GetWindowLongA
GetWindowThreadProcessId
CallWindowProcW
GetForegroundWindow
IsWindowUnicode
SetWindowLongW
IsWindow
SetWindowLongA
GetSystemMenu
AppendMenuA
wsprintfA
CallWindowProcA
KillTimer
SetTimer
UnhookWindowsHookEx
GetMenuItemInfoA
GetClassNameA
CallNextHookEx
SetWindowsHookExA
GetWindowTextA
wvsprintfA
EnumChildWindows
IsWindowVisible

advapi32

AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueA
OpenThreadToken
RegCloseKey
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
RegOpenKeyA
GetUserNameA

Exports

Exports

FCAddDataToKey
FCAddDateToKey
FCAddIntToKey
FCAddStringToKey
FCAssert
FCAssertInternal1
FCAssertParam
FCAssertParamInternal1
FCCleanup
FCClearCounters
FCClearKey
FCClearKeys
FCCreateCounter
FCCreateKey
FCCreatePersistentCounter
FCCreatePersistentKey
FCCreateSupportIncidentInternal
FCDecrementCounter
FCDeleteDataFromKey
FCDeleteDateFromKey
FCDeleteIntFromKey
FCDeleteKey
FCDeleteStringFromKey
FCEndTimer
FCExceptionHandler
FCFlushNonSharedPersistentKeys
FCGetCounter
FCGetSessionUniqueID
FCHeartbeatTimer
FCIncrementCounter
FCInitialize
FCInitializeInternal
FCInitializeWithManifestInternal
FCInitializeWithManifestInternalEx
FCLibraryVersion
FCRegisterMemory
FCRunMemTest
FCSetCounter
FCSetKeyOptions
FCSetLocale
FCSetMiniDump
FCSetUIState
FCStartTimer
FCTrace
FCTraceInternal
FCTraceParam
FCTraceParamInternal
FCTrigger
FCTriggerInternal
FCTriggerInternal1
FCUnregisterMemory

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4a8471176721c0667754c7ab16216f74

Headers

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.rmnet
Size: 56KB - Virtual size: 60KB