3c2fe2dbdf09cfa869344fdb53307cb2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3c2fe2dbdf09cfa869344fdb53307cb2_JaffaCakes118
Size

15KB
MD5

3c2fe2dbdf09cfa869344fdb53307cb2
SHA1

b67a8475e6076a24066b7cb6b36d307244bb741f
SHA256

0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887
SHA512

d6b819643108446b1739cbcb8d5c87e05875d7c1989d03975575c7d808f715ddcce94480860828210970cec8b775c14ee955f99bd6e16f9a32b1d5dafd82dc8c
SSDEEP

192:c1VDVzDJuoJ/a8yRIB4Al4rKoRbFjGgGz3bG8sEwdCs8Ej2uHR0EhBkM2NFU+z4o:c1VxsoNKI++u1qz3K8BwxCO103z4VL2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c2fe2dbdf09cfa869344fdb53307cb2_JaffaCakes118

Files

3c2fe2dbdf09cfa869344fdb53307cb2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3bdaf0330fb6625e9822b4db8158a8ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetSystemTimeAsFileTime

exma-1

disconnectRendezvous
closeRendezvous
sendSockets
readParamsFromEM
writeParamsToEM
recvSocket
connectRendezvous
getDefaultEMFile
bindRendezvous
closeEM
openEMForWriting

tibe-2

TbWinsockCleanup
TbWinsockStartup

trch-1

Parameter_U16_getValue
Paramgroup_getNumParamchoices
Parameter_matchType
Config_getID
Config_getInputParams
Config_getNamespaceUri
Config_getSchemaVersion
Config_getConstants
Config_getOutputParams
Parameter_U16_setValue
Parameter_String_create
Parameter_Boolean_create
Parameter_hasValue
Parameter_String_getValue
Parameter_markInvalid
Parameter_Boolean_getValue
Params_findParamchoice
Config_create
Params_create
Config_setInputParams
Parameter_LocalFile_create
Params_parseCommandLine
Config_delete
Params_isValid
Config_printUsage
Params_printInvalid
Parameter_LocalFile_getValue
Parameter_hasValidValue
Paramgroup_getParamchoice
Socket_type
Scalar_format
Parameter_matchFormat
Parameter_Socket_getValue
Parameter_Socket_setValue
Parameter_Socket_List_getValue
Parameter_Socket_List_setValue
Params_removeParameter
Params_getNumParameters
Params_getParameter
Params_getNumParamchoices
Params_getParamchoice
Paramchoice_hasValidValue
Paramchoice_getValue
Paramchoice_getNumParamgroups
Paramchoice_getParamgroup
Paramgroup_matchName
Config_marshal
Config_unmarshal
Params_findParameter
Parameter_U16_create
Params_addParameter
Parameter_delete
Paramgroup_getNumParameters
Paramgroup_getParameter

tucl-1

TcLog
TcLogClose
TcLogOpen

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
malloc
strncpy
strcat
exit
strrchr
strlen
memcpy
tolower
free
calloc

Exports

Exports

coli_create
coli_delete
coli_setCleanup
coli_setID
coli_setProcess
coli_setValidate
mainWrapper

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3bdaf0330fb6625e9822b4db8158a8ba

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

exma-1

tibe-2

trch-1

tucl-1

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB