39bd82ba140728e82f42a39e485c35f4_JaffaCakes118

General

Target

39bd82ba140728e82f42a39e485c35f4_JaffaCakes118
Size

11KB
MD5

39bd82ba140728e82f42a39e485c35f4
SHA1

53929b9e41b7072d077c9ab0fa48c9871bb73231
SHA256

59c490f1dbb0a21ecbc99f3d128fb8e476b7ba834605dcb39f43df9115a23dac
SHA512

3e0070a4e2e296f629f075c7e3979182f57dd512880558307d7fb2906c4c50cc52defe688d8d2fc98917895ea84236ecf623a8f5136bd3a0be4221d4c13cc08a
SSDEEP

192:NbuVWCWiyd5gbMI4jHcknKdNgjX3K2poGQZLT2i21CxzvtM1CxjX9OeA3XHPVR6u:kVWCWiyd5gbMI4jHcknKOX3zOZv2i21J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39bd82ba140728e82f42a39e485c35f4_JaffaCakes118

Files

39bd82ba140728e82f42a39e485c35f4_JaffaCakes118
.dll windows:5 windows x86 arch:x86

f1025efb46e0ccb6a27470b11b228267

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

xbe.pdb

Imports

ida.wll

areacb_t_get_area
segs
vset_segm_name
do_data_ex
callui
vloader_failure
set_name
qlread
qlseek
qstrncpy
get_long
create_filename_cmt
inf
set_default_dataseg
set_segm_class
add_segm_ex
put_long
qlgetz
set_segm_addressing
add_segm
allocate_selector
file2base
lread
qlsize
free_ioports
find_ioport
isLoaded
read_ioports
add_entry
isEnabled
set_processor_type

msvcr100

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
EncodePointer
DecodePointer

Exports

Exports

LDSC

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 542B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1025efb46e0ccb6a27470b11b228267

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ida.wll

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 542B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 542B