f1b15e722f7009aece584637b90f4b0b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f1b15e722f7009aece584637b90f4b0b_JaffaCakes118
Size

298KB
MD5

f1b15e722f7009aece584637b90f4b0b
SHA1

826427783d9d19eb9c50499b60583abb32f665cc
SHA256

f0bdaad40c562c35aaf302e4ff49b4c8c2cd07efc4a7a1ef60126fcc682166d9
SHA512

cbf37b1d7e39a3f19ce7ddbeeee047407975b01f4c58dad1c34ddc3e281005e2a1ad6fed7d58b54e9f92b7c02097da4533f7257d679b6e6016d7284d434fd98a
SSDEEP

6144:lQQQSOHU+ZJlp+LrZhA7urEP2s6RKxN5:NQH0+ZJL+XgN2PKr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1b15e722f7009aece584637b90f4b0b_JaffaCakes118

Files

f1b15e722f7009aece584637b90f4b0b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

bfd9e85f37387f64fac668b9c1434f88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Solutions\SafetyShifting\Release\Jesenice.pdb

Imports

ntdll

RtlCaptureStackBackTrace
RtlUnwind

ws2_32

WSAConnect

kernel32

GetFileSize
GetLastError
SetLastError
GetSystemDirectoryA
DeleteCriticalSection
TlsGetValue
Sleep
LeaveCriticalSection
EnterCriticalSection
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
CreateEventA
CreateMutexA
ReleaseMutex
SetCurrentDirectoryA
DeviceIoControl
CreateFileMappingA
SetCommState
GetCommState
GetLocalTime
ExitProcess
SetStdHandle
GetStdHandle
SetFilePointer
WriteFile
lstrlenA
CreateDirectoryA
CreateRemoteThread
HeapDestroy
HeapValidate
HeapCreate
LocalFree
GetModuleHandleW
SetFilePointerEx
CreateFileMappingW
FindClose
GetVolumeInformationA
FindNextFileA
CloseHandle
SystemTimeToFileTime
DeleteFileA
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryW
FreeLibrary
GetFileInformationByHandle
GetCurrentThreadId
GetStringTypeW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetModuleFileNameW
MultiByteToWideChar
LCMapStringW
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsAlloc
EncodePointer
IsValidCodePage
InitializeCriticalSection
WideCharToMultiByte
HeapReAlloc
FindFirstFileA
HeapSize
HeapFree
HeapAlloc
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP

user32

RedrawWindow
GetKeyState
IsClipboardFormatAvailable
MessageBoxA
GetUserObjectInformationA
SetUserObjectInformationA
CloseDesktop
CreateDesktopA
GetMouseMovePointsEx
GetMenuStringA
GetWindowPlacement
DispatchMessageA
DrawStateW
GetProcessWindowStation
SetProcessWindowStation
CreateWindowExA
GetLastActivePopup
InvalidateRgn
IsWindow
SendMessageA
CharUpperBuffA
KillTimer
SetTimer
DrawIconEx
UpdateWindow
InvalidateRect
DestroyWindow
CreateWindowExW
GetForegroundWindow

advapi32

RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA

Exports

Exports

ServiceMain
dns_a4todn_
dns_add_srch
dns_dnlabels
dns_getstr
dns_parse_a
dns_parse_mx
dns_rhsbltodn
dns_skipdn
dns_submit_a6dnsbl
dns_xntop
dnscb
dnserror
night_shift
printdate
query_new
submit_a_queries
udns_jranval
warnx

Sections

.text
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfd9e85f37387f64fac668b9c1434f88

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

ws2_32

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 243KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 22KB - Virtual size: 39KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 244KB - Virtual size: 243KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 22KB - Virtual size: 39KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 6KB - Virtual size: 6KB