3b2e0f00903846ada8a903ba2c24f156_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3b2e0f00903846ada8a903ba2c24f156_JaffaCakes118
Size

30KB
MD5

3b2e0f00903846ada8a903ba2c24f156
SHA1

d0645e256bb1e3062ee816d9d35b86a9b9ce0b77
SHA256

3b6fb86196112ac2d039db10ce96ed3939357e012197753f6cff9e791af57ce6
SHA512

aaecbdcf4e05ee6e2178fbb556f5bf3127b9ae9dc1b22e06824b591b691220c4f509ef3a4bdca0becb3a1865ba95db7e3dfa5d2384e1e963cfd2d86164103140
SSDEEP

384:P9uwbryy8asx/uYjA2yZULYmHSIeYMHAHVe1J7vvxlLEAwqyOaeS+WPiW:P0iyWsNbDmU0mHSIexv1J7DEl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b2e0f00903846ada8a903ba2c24f156_JaffaCakes118

Files

3b2e0f00903846ada8a903ba2c24f156_JaffaCakes118
.dll windows:10 windows x86 arch:x86

baddd1ab614c8aa15983c792dbbf6bb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

free

ntdll

EtwTraceMessage

rpcrt4

NdrClientCall4

api-ms-win-core-synch-l1-1-0

SetEvent

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-heap-l1-1-0

HeapFree

api-ms-win-security-base-l1-1-0

FreeSid

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-memory-l1-1-0

MapViewOfFile

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

kernelbase

WTSIsServerContainer

sysntfy

SysNotifyStopServer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

SensNotifyNetconEvent
SensNotifyRasEvent
SensNotifyWinlogonEvent
ServiceMain
SvchostPushServiceGlobals

Sections

.MPRESS1
Size: 18KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baddd1ab614c8aa15983c792dbbf6bb4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

kernelbase

sysntfy

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.MPRESS1 Size: 18KB - Virtual size: 64KB

.MPRESS2 Size: 5KB - Virtual size: 4KB

.rsrc Size: 6KB - Virtual size: 5KB

.MPRESS1
Size: 18KB - Virtual size: 64KB

.MPRESS2
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 6KB - Virtual size: 5KB