f277ea5cbf3002413e1566bb334e4929_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f277ea5cbf3002413e1566bb334e4929_JaffaCakes118
Size

182KB
MD5

f277ea5cbf3002413e1566bb334e4929
SHA1

942a32c7e5b2f361e6828ad40e8a14696edc94f6
SHA256

e4c32211f77e5cd552b182fd9a4ba24dab4eb6e2b03b79046e3fa275e09fd232
SHA512

5461b8c1833dc7aeb3cc01b0cf29bb1c2c9049e1c8bff1fd8881d0eec88f0226c8a65742d49f9e5bd867f885aa9c7c44cdd42a393b7566470e2e035b015d3dda
SSDEEP

3072:54w2aJF+su7sJGPZKpGuMC6YQETOjzpI6gUXaZlMRCa5kuI5V:W1IF+suKQZYGuMC+I5WanMR9pIn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f277ea5cbf3002413e1566bb334e4929_JaffaCakes118

Files

f277ea5cbf3002413e1566bb334e4929_JaffaCakes118
.dll windows:6 windows x86 arch:x86

5d03eee2c2ba38ed383375ffe31b3195

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsldp.pdb

Imports

msvcrt

_purecall
_except_handler4_common
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wtoi64
wcstok
swscanf_s
_wtol
_ltow
_itow_s
_wcslwr
wcsstr
_wcsnicmp
qsort
wcschr
memcpy
wcscpy_s
memset
_wcsicmp
swprintf_s
wcscat_s
wcsncpy_s

activeds

ord3
ord31
ord25
ord22
ord26
ord27
ord28
ord16
ord12
ord17
ord18
ord15
ord14
ord7

adsldpc

ADSIPrint
AdsTypeToLdapTypeCopyTime
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
LdapTypeToAdsTypeUTCTime
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeDNWithBinary
LdapGetDn
LdapTypeFreeLdapModList
LdapTypeCopyConstruct
LdapValueFreeLen
UnMarshallLDAPToLDAPSynID
LdapNextAttribute
LdapAttributeFree
LdapFirstAttribute
LdapTypeFreeLdapModObject
LdapModifyExtS
ReadSecurityDescriptorControlType
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
LdapAddExtS
LdapDeleteS
GetServerAndPort
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
LdapTypeToAdsTypeCopyConstruct
LdapDeleteExtS
LdapcSetStickyServer
BerEncodingQuotaControl
?SetFSlashDisabler@CLexer@@QAEXH@Z
BuildADsParentPathFromObjectInfo2
GetLDAPTypeName
LdapInitializeSearchPreferences
LdapTypeBinaryToString
MapLDAPTypeToADSType
MapADSTypeToLDAPType
ADsSetObjectAttributes
ADsGetObjectAttributes
ADsDeleteDSObject
ADsCreateDSObjectExt
ADsSetSearchPreference
ADsExecuteSearch
ADsAbandonSearch
ADsCloseSearchHandle
ADsGetFirstRow
ADsGetNextRow
ADsGetPreviousRow
ADsGetColumn
ADsGetNextColumnName
ADsFreeColumn
ADsEnumAttributes
ADsCreateAttributeDefinition
ADsWriteAttributeDefinition
ADsDeleteAttributeDefinition
ADsEnumClasses
ADsCreateClassDefinition
ADsWriteClassDefinition
ADsDeleteClassDefinition
LdapcKeepHandleAround
LdapGetSyntaxIdOfAttribute
LdapCacheAddRef
ADsHelperGetCurrentRowMessage
BuildADsPathFromParent
LdapSearchAbandonPage
LdapModDnS
LdapNextEntry
LdapMemFree
ReadPagingSupportedAttr
LdapSearchInitPage
LdapSearchExtS
LdapGetNextPageS
GetDefaultServer
LdapOpenObject2
LdapReadAttributeFast
BuildADsPathFromLDAPPath2
BuildADsParentPath
IsGCNamespace
GetDisplayName
??0CLexer@@QAE@XZ
?InitializePath@CLexer@@QAEJPAG@Z
InitObjectInfo
?SetAtDisabler@CLexer@@QAEXH@Z
Component
??1CLexer@@QAE@XZ
PathName
?GetNextToken@CLexer@@QAEJPAGPAK@Z
SchemaGetObjectCount
SchemaGetPropertyInfoByIndex
SchemaGetClassInfoByIndex
SchemaAddRef
SchemaGetPropertyInfo
SchemaOpen
SchemaGetClassInfo
LdapModifyS
LdapReadAttribute
LdapAddS
SchemaClose
FindEntryInSearchTable
intcmp
FindSearchTableIndex
SortAndRemoveDuplicateOIDs
LdapOpenObject
LdapSearchS
LdapCountEntries
LdapFirstEntry
LdapGetValues
LdapCloseObject
LdapMsgFree
LdapValueFree
SchemaGetStringsFromStringTable
LdapGetSyntaxOfAttributeOnServer
SchemaGetSyntaxOfAttribute
BuildLDAPPathFromADsPath2
LdapMakeSchemaCacheObsolete
LdapGetSubSchemaSubEntryPath
LdapGetSchemaObjectCount
LdapTypeFreeLdapObjects
ADsObject
FreeObjectInfo
LdapTypeToAdsTypeDNWithString
LdapRenameExtS

wldap32

ord54
ord12
ord53

netapi32

NetApiBufferFree

ole32

CreatePointerMoniker
CLSIDFromString
CoTaskMemFree
StringFromGUID2
IIDFromString
StringFromCLSID
CoCreateInstance

advapi32

RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegQueryValueExW
RegEnumKeyExW
SystemFunction040
SystemFunction041
RegSetValueExW

kernel32

LoadLibraryW
FreeLibrary
LeaveCriticalSection
GetLastError
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
lstrlenW
RaiseException
LocalAlloc
LocalFree
CompareStringW
GetTickCount
InterlockedDecrement
InterlockedIncrement
SetLastError
GetSystemDirectoryW

oleaut32

SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetElement
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
VariantCopyInd
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantInit
LoadRegTypeLi
DispInvoke
SetErrorInfo
CreateErrorInfo
VariantClear
DispGetIDsOfNames
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d03eee2c2ba38ed383375ffe31b3195

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

activeds

adsldpc

wldap32

netapi32

ole32

advapi32

kernel32

oleaut32

Exports

Exports

Sections

.text Size: 157KB - Virtual size: 157KB

.data Size: 15KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 157KB - Virtual size: 157KB

.data
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB