e77f6cc490082581e45089805619adab_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e77f6cc490082581e45089805619adab_JaffaCakes118
Size

20KB
MD5

e77f6cc490082581e45089805619adab
SHA1

d9696bd00aaa628036b7c11636010047261ddcf8
SHA256

3ccbd18736f1820f256e95a43097ed379df72c62a543d912d881db7915c04bfb
SHA512

06632a0848aa9bf97f88db88dc0630c0aa0f09beef0979313faf2bbb1aea70e397fedfb3cb09ae3a92a5affed520f34fe48b816f5ab64e8a5009f554bc1c901e
SSDEEP

384:wDK4mcu14VRkNoeE3loml436fgzmo32fKq:wDQcMOELE3aW4q4atv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e77f6cc490082581e45089805619adab_JaffaCakes118

Files

e77f6cc490082581e45089805619adab_JaffaCakes118
.dll windows:6 windows x64 arch:x64

a3f2bc0f779526ffefcb342713ce841b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Desktop\IIS-Raid-master\module\x64\Release\IIS-Backdoor.pdb

Imports

kernel32

CloseHandle
VirtualFree
ReadFile
CreateProcessW
VirtualAllocEx
WriteProcessMemory
GetThreadContext
CreateProcessA
ResumeThread
GetSystemTime
CreateFileA
SetFilePointer
WriteFile
CompareStringA
VirtualAlloc
CreatePipe
DebugBreak
SetThreadContext
OutputDebugStringA
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

vcruntime140

__std_exception_copy
memset
memcpy
strstr
__C_specific_handler
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

_initterm
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e

api-ms-win-crt-string-l1-1-0

strcmp

Exports

Exports

RegisterModule

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3f2bc0f779526ffefcb342713ce841b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

crypt32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 1020B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 220B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 1020B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 220B