f832a43ce3b5a58bffc6d58787dfdc2d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f832a43ce3b5a58bffc6d58787dfdc2d_JaffaCakes118
Size

394KB
MD5

f832a43ce3b5a58bffc6d58787dfdc2d
SHA1

b6248a0acede94ba39e4b526e90ce7f669ba1b70
SHA256

53cdd66e3c5f2b36d60ce447f1eaae375fcc11f624d637321ca0e63fa92fbecc
SHA512

6b8cde5e67eb11ee09254c1ea7fa484120c9f797d022ad41e0f6fcf90c43e6311275d016884d235bf939f243c8c3102e656381d6a3b231dba1af59b0a8f09e83
SSDEEP

6144:WRD4MlqMABEN37jt9ZA3H8DaLCw0w6LhMA8aF8pVqEDFqf1b/3C:WRZQOrcHwwH6tMzaFg8EDcf1r3C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f832a43ce3b5a58bffc6d58787dfdc2d_JaffaCakes118

Files

f832a43ce3b5a58bffc6d58787dfdc2d_JaffaCakes118
.dll windows:4 windows x64 arch:x64

f7d8d90ab54224232700ea66b03425f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

__chkstk

shlwapi

StrStrIW

winmm

mciSendStringA
waveInGetDevCapsA
mciSendStringW
midiOutReset
waveInGetDevCapsW
midiOutGetDevCapsW
auxGetDevCapsW
waveOutSetPitch
midiInStart

user32

GetTopWindow

advapi32

CopySid

Exports

Exports

IsInteractiveUserSession
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
WTSCloseServer
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnableChildSessions
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetChildSessionId
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSIsChildSessionsEnabled
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetRenderHint
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pwmi
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uclgtf
Size: 1024B - Virtual size: 735B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kjc
Size: 1024B - Virtual size: 735B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zlr
Size: 1024B - Virtual size: 735B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dsd
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.butmi
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fcrpa
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wldv
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7d8d90ab54224232700ea66b03425f4

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

winmm

user32

advapi32

Exports

Exports

Sections

.text Size: 130KB - Virtual size: 129KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 6KB - Virtual size: 5KB

.pdata Size: 1024B - Virtual size: 540B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 12KB

.pwmi Size: 2KB - Virtual size: 2KB

.uclgtf Size: 1024B - Virtual size: 735B

.kjc Size: 1024B - Virtual size: 735B

.zlr Size: 1024B - Virtual size: 735B

.dsd Size: 3KB - Virtual size: 3KB

.butmi Size: 2KB - Virtual size: 2KB

.fcrpa Size: 2KB - Virtual size: 2KB

.wldv Size: 2KB - Virtual size: 2KB

.text
Size: 130KB - Virtual size: 129KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 6KB - Virtual size: 5KB

.pdata
Size: 1024B - Virtual size: 540B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 12KB

.pwmi
Size: 2KB - Virtual size: 2KB

.uclgtf
Size: 1024B - Virtual size: 735B

.kjc
Size: 1024B - Virtual size: 735B

.zlr
Size: 1024B - Virtual size: 735B

.dsd
Size: 3KB - Virtual size: 3KB

.butmi
Size: 2KB - Virtual size: 2KB

.fcrpa
Size: 2KB - Virtual size: 2KB

.wldv
Size: 2KB - Virtual size: 2KB