f7b50e337295fd05c3313612de5fc92b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f7b50e337295fd05c3313612de5fc92b_JaffaCakes118
Size

855KB
MD5

f7b50e337295fd05c3313612de5fc92b
SHA1

c4876baa3e69dba6fae3a401de29d3f25228ff58
SHA256

819d3bc8374465dbbb48cf2b0121b8c223c36523fc1f53046db7a37fdb622be5
SHA512

3a430a748d97d0ba11ec87b785a4e86e237ad3b8a2cd546e5be9247112772c137555e12c6acfe74db6ad4f4246fa56c6b023e6f64e9ebb340abfc27b90074cce
SSDEEP

24576:58SM2BA40m11XOB+7uDyrAbidxojyj7vhcNtqpSZQsL9:DBA4911XOg+6oIxojyvZktqpS+sL9

Score

1^/10

Malware Config

Signatures

Files

f7b50e337295fd05c3313612de5fc92b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

608ae5bf319a6ba504eb2e1411c3750f

Code Sign

4b:13:df:26:5f:ff:c8:71:b2:eb:e8:4e:d4:c8:d2:35
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2008

Not Before

11/03/2020, 02:01

Not After

31/12/2039, 23:59

Subject

CN=Microsoft Windows

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
ExitProcess
CreateRemoteThread
GetLastError
WriteProcessMemory
ReleaseMutex
CloseHandle
GetSystemInfo
lstrcmpiW
lstrcatW
CreateMutexA
LoadLibraryA
LoadLibraryW
GetModuleFileNameA
OpenProcess
CreateProcessW
GetSystemDirectoryW
GetWindowsDirectoryW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
IsWow64Process
VirtualAllocEx
VirtualAlloc
GlobalMemoryStatus
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleA
VerSetConditionMask
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetACP
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
SetStdHandle
WriteConsoleW
CreateFileW
HeapSize
HeapReAlloc
DecodePointer

user32

wsprintfA

advapi32

RegOpenKeyExA
RegCreateKeyA
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExA

Exports

Exports

AddIPAddress
AllocateAndGetInterfaceInfoFromStack
AllocateAndGetIpAddrTableFromStack
CPNatfwtCreateProviderInstance
CPNatfwtDeregisterProviderInstance
CPNatfwtDestroyProviderInstance
CPNatfwtIndicateReceivedBuffers
CPNatfwtRegisterProviderInstance
CancelIPChangeNotify
CancelMibChangeNotify2
ConvertGuidToStringA
ConvertGuidToStringW
ConvertInterfaceAliasToLuid
ConvertInterfaceGuidToLuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToAlias
ConvertInterfaceLuidToGuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameA
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidA
ConvertInterfaceNameToLuidW
ConvertInterfacePhysicalAddressToLuid
ConvertIpv4MaskToLength
ConvertLengthToIpv4Mask
ConvertRemoteInterfaceAliasToLuid
ConvertRemoteInterfaceGuidToLuid
ConvertRemoteInterfaceIndexToLuid
ConvertRemoteInterfaceLuidToAlias
ConvertRemoteInterfaceLuidToGuid
ConvertRemoteInterfaceLuidToIndex
ConvertStringToGuidA
ConvertStringToGuidW
ConvertStringToInterfacePhysicalAddress
CreateAnycastIpAddressEntry
CreateIpForwardEntry
CreateIpForwardEntry2
CreateIpNetEntry
CreateIpNetEntry2
CreatePersistentTcpPortReservation
CreatePersistentUdpPortReservation
CreateProxyArpEntry
CreateSortedAddressPairs
CreateUnicastIpAddressEntry
DeleteAnycastIpAddressEntry
DeleteIPAddress
DeleteIpForwardEntry
DeleteIpForwardEntry2
DeleteIpNetEntry
DeleteIpNetEntry2
DeletePersistentTcpPortReservation
DeletePersistentUdpPortReservation
DeleteProxyArpEntry
DeleteUnicastIpAddressEntry
DisableMediaSense
EnableRouter
FlushIpNetTable
FlushIpNetTable2
FlushIpPathTable
FreeMibTable
GetAdapterIndex
GetAdapterOrderMap
GetAdaptersAddresses
GetAdaptersInfo
GetAnycastIpAddressEntry
GetAnycastIpAddressTable
GetBestInterface
GetBestInterfaceEx
GetBestRoute
GetBestRoute2
GetCurrentThreadCompartmentId
GetExtendedTcpTable
GetExtendedUdpTable
GetFriendlyIfIndex
GetIcmpStatistics
GetIcmpStatisticsEx
GetIfEntry
GetIfEntry2
GetIfStackTable
GetIfTable
GetIfTable2
GetIfTable2Ex
GetInterfaceInfo
GetInvertedIfStackTable
GetIpAddrTable
GetIpErrorString
GetIpForwardEntry2
GetIpForwardTable
GetIpForwardTable2
GetIpInterfaceEntry
GetIpInterfaceTable
GetIpNetEntry2
GetIpNetTable
GetIpNetTable2
GetIpPathEntry
GetIpPathTable
GetIpStatistics
GetIpStatisticsEx
GetMulticastIpAddressEntry
GetMulticastIpAddressTable
GetNetworkInformation
GetNetworkParams
GetNumberOfInterfaces
GetOwnerModuleFromPidAndInfo
GetOwnerModuleFromTcp6Entry
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromUdp6Entry
GetOwnerModuleFromUdpEntry
GetPerAdapterInfo
GetPerTcp6ConnectionEStats
GetPerTcp6ConnectionStats
GetPerTcpConnectionEStats
GetPerTcpConnectionStats
GetRTTAndHopCount
GetSessionCompartmentId
GetTcp6Table
GetTcp6Table2
GetTcpStatistics
GetTcpStatisticsEx
GetTcpTable
GetTcpTable2
GetTeredoPort
GetUdp6Table
GetUdpStatistics
GetUdpStatisticsEx
GetUdpTable
GetUniDirectionalAdapterInfo
GetUnicastIpAddressEntry
GetUnicastIpAddressTable
Icmp6CreateFile
Icmp6ParseReplies
Icmp6SendEcho2
IcmpCloseHandle
IcmpCreateFile
IcmpParseReplies
IcmpSendEcho
IcmpSendEcho2
IcmpSendEcho2Ex
InitializeIpForwardEntry
InitializeIpInterfaceEntry
InitializeUnicastIpAddressEntry
InternalCleanupPersistentStore
InternalCreateAnycastIpAddressEntry
InternalCreateIpForwardEntry
InternalCreateIpForwardEntry2
InternalCreateIpNetEntry
InternalCreateIpNetEntry2
InternalCreateUnicastIpAddressEntry
InternalDeleteAnycastIpAddressEntry
InternalDeleteIpForwardEntry
InternalDeleteIpForwardEntry2
InternalDeleteIpNetEntry
InternalDeleteIpNetEntry2
InternalDeleteUnicastIpAddressEntry
InternalFindInterfaceByAddress
InternalGetAnycastIpAddressEntry
InternalGetAnycastIpAddressTable
InternalGetForwardIpTable2
InternalGetIfEntry2
InternalGetIfTable
InternalGetIfTable2
InternalGetIpAddrTable
InternalGetIpForwardEntry2
InternalGetIpForwardTable
InternalGetIpInterfaceEntry
InternalGetIpInterfaceTable
InternalGetIpNetEntry2
InternalGetIpNetTable
InternalGetIpNetTable2
InternalGetMulticastIpAddressEntry
InternalGetMulticastIpAddressTable
InternalGetTcp6Table2
InternalGetTcp6TableWithOwnerModule
InternalGetTcp6TableWithOwnerPid
InternalGetTcpTable
InternalGetTcpTable2
InternalGetTcpTableEx
InternalGetTcpTableWithOwnerModule
InternalGetTcpTableWithOwnerPid
InternalGetTunnelPhysicalAdapter
InternalGetUdp6TableWithOwnerModule
InternalGetUdp6TableWithOwnerPid
InternalGetUdpTable
InternalGetUdpTableEx
InternalGetUdpTableWithOwnerModule
InternalGetUdpTableWithOwnerPid
InternalGetUnicastIpAddressEntry
InternalGetUnicastIpAddressTable
InternalSetIfEntry
InternalSetIpForwardEntry
InternalSetIpForwardEntry2
InternalSetIpInterfaceEntry
InternalSetIpNetEntry
InternalSetIpNetEntry2
InternalSetIpStats
InternalSetTcpEntry
InternalSetTeredoPort
InternalSetUnicastIpAddressEntry
IpReleaseAddress
IpRenewAddress
LookupPersistentTcpPortReservation
LookupPersistentUdpPortReservation
NTPTimeToNTFileTime
NTTimeToNTPTime
NhGetGuidFromInterfaceName
NhGetInterfaceDescriptionFromGuid
NhGetInterfaceNameFromDeviceGuid
NhGetInterfaceNameFromGuid
NhpAllocateAndGetInterfaceInfoFromStack
NotifyAddrChange
NotifyIpInterfaceChange
NotifyRouteChange
NotifyRouteChange2
NotifyStableUnicastIpAddressTable
NotifyTeredoPortChange
NotifyUnicastIpAddressChange
ParseNetworkString
ResolveIpNetEntry2
ResolveNeighbor
RestoreMediaSense
SendARP
SetAdapterIpAddress
SetCurrentThreadCompartmentId
SetIfEntry
SetIpForwardEntry
SetIpForwardEntry2
SetIpInterfaceEntry
SetIpNetEntry
SetIpNetEntry2
SetIpStatistics
SetIpStatisticsEx
SetIpTTL
SetNetworkInformation
SetPerTcp6ConnectionEStats
SetPerTcp6ConnectionStats
SetPerTcpConnectionEStats
SetPerTcpConnectionStats
SetSessionCompartmentId
SetTcpEntry
SetUnicastIpAddressEntry
UnenableRouter
_PfAddFiltersToInterface@24
_PfAddGlobalFilterToInterface@8
_PfBindInterfaceToIPAddress@12
_PfBindInterfaceToIndex@16
_PfCreateInterface@24
_PfDeleteInterface@4
_PfDeleteLog@0
_PfGetInterfaceStatistics@16
_PfMakeLog@4
_PfRebindFilters@8
_PfRemoveFilterHandles@12
_PfRemoveFiltersFromInterface@20
_PfRemoveGlobalFilterFromInterface@8
_PfSetLogBuffer@28
_PfTestPacket@20
_PfUnBindInterface@4
do_echo_rep
do_echo_req
if_indextoname
if_nametoindex
register_icmp

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.v-lizer
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

608ae5bf319a6ba504eb2e1411c3750f

Code Sign

4b:13:df:26:5f:ff:c8:71:b2:eb:e8:4e:d4:c8:d2:35Certificate

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 99KB - Virtual size: 98KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 140KB - Virtual size: 142KB

.gfids Size: 512B - Virtual size: 196B

.rsrc Size: 1024B - Virtual size: 864B

.v-lizer Size: 568KB - Virtual size: 568KB

4b:13:df:26:5f:ff:c8:71:b2:eb:e8:4e:d4:c8:d2:35
Certificate

.text
Size: 99KB - Virtual size: 98KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 140KB - Virtual size: 142KB

.gfids
Size: 512B - Virtual size: 196B

.rsrc
Size: 1024B - Virtual size: 864B

.v-lizer
Size: 568KB - Virtual size: 568KB