ea6ecdb219b80d85b984b4fb32153a9d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ea6ecdb219b80d85b984b4fb32153a9d_JaffaCakes118
Size

54KB
MD5

ea6ecdb219b80d85b984b4fb32153a9d
SHA1

a58483b517f17a524b5f814ae0691f8d49bad204
SHA256

2a3cd8c2766f46c6c66ee46e860c5a088c384bfccf3a05f3f79a212b4491990c
SHA512

8ba8a9aa964ab637d9c656a823e9b4f186b9ac9dd6eaaad83e52ed7c03fd4c4f76b9c9ae71300500f24c2395d631220448e85c2f18ff645bd041cf51485baffe
SSDEEP

768:tPVA2HWDmxy7BvOFnjGx+uJgCR6OxSUNgi9Z/BJTP7K+fZM4gU1S9HKKVBWZL7q:tPGIWuks/uJg0t7TjKuM4LY8KVBM3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea6ecdb219b80d85b984b4fb32153a9d_JaffaCakes118

Files

ea6ecdb219b80d85b984b4fb32153a9d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

57f6db956546e95150bbe9a7ed2cdcaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FormatMessageW
WriteConsoleW
LocalAlloc
WriteFile
LocalFree
GetStdHandle
GetFileType
GetConsoleMode
LoadLibraryW
GetLastError
GetProcAddress
SetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
Sleep
InterlockedExchange
InterlockedCompareExchange
HeapFree
GetCurrentProcess
GetCurrentDirectoryW
LoadLibraryExA
ResumeThread
SetEvent
UnregisterWait
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueueUserWorkItem
TerminateProcess
CloseHandle
WriteProcessMemory
DuplicateHandle
ReadProcessMemory
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapAlloc
GetProcessHeap
FreeLibrary
GetTickCount
GetCommandLineA
OpenProcess
VirtualProtect

user32

CharToOemW

advapi32

RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExW

rpcrt4

RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelfEx
RpcImpersonateClient

msvcrt

_wtoi
_vsnwprintf
_except_handler3
_initterm
memset
_wcsicmp
_XcptFilter
free
malloc
_adjust_fdiv
__CxxFrameHandler
_unlock

msvcp60

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57f6db956546e95150bbe9a7ed2cdcaa

Headers

File Characteristics

Imports

kernel32

user32

advapi32

rpcrt4

msvcrt

msvcp60

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB