492d07d79e7024ca310867b526d9636d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

492d07d79e7024ca310867b526d9636d_JaffaCakes118
Size

349KB
MD5

492d07d79e7024ca310867b526d9636d
SHA1

9c816377412cccfce3bc66c2cc36cf2406b7e19c
SHA256

f2fe647ab85c6c3c1aa3df4bce6e4d42b9676c9d837e11388c235ae8db20044f
SHA512

2021a86619db7755d27a29b45b9c5881591e7bddbbfa615c4624a5ac1a2e08b7f5569d0e4add2cfc00c7484459f93dbedd3c6b9717fce4a295c818632a7e57f6
SSDEEP

6144:HZ9+aOfkRGPWmhKEquylTU1oPaZXNPxnNzx02kecuUPxTrsdf6awqr5:5oaOfkabqVj+7menUl6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
492d07d79e7024ca310867b526d9636d_JaffaCakes118

Files

492d07d79e7024ca310867b526d9636d_JaffaCakes118
.dll windows:6 windows x64 arch:x64

57f6880dcc4cd035d4551284e8c7e181

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dnsapi.pdb

Imports

msvcrt

_amsg_exit
free
_initterm
__C_specific_handler
malloc
_XcptFilter
memcpy
towlower
wcschr
atoi
_strlwr
strncmp
_strupr
strtoul
memset
_vsnprintf
wcstoul
_stricmp
rand
srand
_strnicmp
_wcsicmp
_wcsnicmp
fputs
fprintf
localtime
time
fgets
strpbrk
fclose
fopen
rewind
_vsnwprintf
memcmp

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW

api-ms-win-core-localregistry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-misc-l1-1-0

LocalFree
Sleep
LocalReAlloc
LocalAlloc

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
GetSystemDirectoryA
GetTickCount64

api-ms-win-core-synch-l1-1-0

ReleaseMutex
InitializeCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
CreateEventA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepEx
WaitForMultipleObjectsEx
ReleaseSemaphore
WaitForSingleObject
SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
CreateSemaphoreExW

ws2_32

connect
recv
ntohs
setsockopt
WSASocketW
closesocket
WSAIoctl
listen
shutdown
WSAJoinLeaf
__WSAFDIsSet
select
sendto
getservbyport
getprotobynumber
ntohl
getprotobyname
inet_addr
htonl
htons
WSACleanup
WSAStartup
FreeAddrInfoW
GetAddrInfoW
inet_ntoa
WSAGetLastError
bind
send
getsockname

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
WinSqmSetDWORD
WinSqmIsOptedIn
EtwLogTraceEvent
EtwEventWrite
EtwEventEnabled
EvtIntReportEventAndSourceAsync
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlIpv6StringToAddressExA
RtlIpv6StringToAddressA
RtlIpv4StringToAddressA
RtlIpv6StringToAddressExW
RtlIpv6AddressToStringA
RtlCreateHeap
RtlFreeHeap
RtlDestroyHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlDeleteCriticalSection
RtlInitializeCriticalSection
EtwTraceMessage

nsi

NsiAllocateAndGetTable
NsiFreeTable
NsiGetParameter

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernelbase

CompareStringA

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-localization-l1-1-0

LCMapStringW

Exports

Exports

BreakRecordsIntoBlob
CombineRecordsInBlob
DnsAcquireContextHandle_A
DnsAcquireContextHandle_W
DnsAllocateRecord
DnsApiAlloc
DnsApiAllocZero
DnsApiFree
DnsApiHeapReset
DnsApiRealloc
DnsApiSetDebugGlobals
DnsAsyncRegisterHostAddrs
DnsAsyncRegisterInit
DnsAsyncRegisterTerm
DnsCopyStringEx
DnsCreateReverseNameStringForIpAddress
DnsCreateStandardDnsNameCopy
DnsCreateStringCopy
DnsDhcpRegisterAddrs
DnsDhcpRegisterHostAddrs
DnsDhcpRegisterInit
DnsDhcpRegisterTerm
DnsDhcpRemoveRegistrations
DnsDhcpSrvRegisterHostAddr
DnsDhcpSrvRegisterHostAddrEx
DnsDhcpSrvRegisterHostName
DnsDhcpSrvRegisterHostNameEx
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterTerm
DnsDowncaseDnsNameLabel
DnsExtractRecordsFromMessage_UTF8
DnsExtractRecordsFromMessage_W
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_A
DnsFlushResolverCacheEntry_UTF8
DnsFlushResolverCacheEntry_W
DnsFree
DnsFreeConfigStructure
DnsFreePolicyConfig
DnsFreeProxyName
DnsGetBufferLengthForStringCopy
DnsGetCacheDataTable
DnsGetDnsServerList
DnsGetDomainName
DnsGetLastFailedUpdateInfo
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPrimaryDomainName_A
DnsGetProxyInfoPrivate
DnsGetProxyInformation
DnsGlobals
DnsIpv6AddressToString
DnsIpv6StringToAddress
DnsIsAMailboxType
DnsIsStatusRcode
DnsIsStringCountValidForTextType
DnsLogEvent
DnsLogIn
DnsLogInit
DnsLogIt
DnsLogOut
DnsLogTime
DnsMapRcodeToStatus
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_UTF8
DnsModifyRecordsInSet_W
DnsNameCompareEx_A
DnsNameCompareEx_UTF8
DnsNameCompareEx_W
DnsNameCompare_A
DnsNameCompare_UTF8
DnsNameCompare_W
DnsNameCopy
DnsNameCopyAllocate
DnsNetworkInfo_CreateFromFAZ
DnsNetworkInformation_CreateFromFAZ
DnsNotifyResolver
DnsNotifyResolverClusterIp
DnsNotifyResolverEx
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigDword
DnsQueryExA
DnsQueryExUTF8
DnsQueryExW
DnsQuery_A
DnsQuery_UTF8
DnsQuery_W
DnsRecordBuild_UTF8
DnsRecordBuild_W
DnsRecordCompare
DnsRecordCopyEx
DnsRecordListFree
DnsRecordSetCompare
DnsRecordSetCopyEx
DnsRecordSetDetach
DnsRecordStringForType
DnsRecordStringForWritableType
DnsRecordTypeForName
DnsRegisterClusterAddress
DnsReleaseContextHandle
DnsRemoveRegistrations
DnsReplaceRecordSetA
DnsReplaceRecordSetUTF8
DnsReplaceRecordSetW
DnsResolverOp
DnsScreenLocalAddrsForRegistration
DnsSetConfigDword
DnsStatusString
DnsStringCopyAllocateEx
DnsTraceServerConfig
DnsUnicodeToUtf8
DnsUpdate
DnsUpdateMachinePresence
DnsUpdateTest_A
DnsUpdateTest_UTF8
DnsUpdateTest_W
DnsUtf8ToUnicode
DnsValidateNameOrIp_TempW
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateName_W
DnsValidateServerArray_A
DnsValidateServerArray_W
DnsValidateServerStatus
DnsValidateServer_A
DnsValidateServer_W
DnsValidateUtf8Byte
DnsWriteQuestionToBuffer_UTF8
DnsWriteQuestionToBuffer_W
DnsWriteReverseNameStringForIpAddress
Dns_AddRecordsToMessage
Dns_AllocateMsgBuf
Dns_BuildPacket
Dns_CleanupWinsock
Dns_CloseConnection
Dns_CloseSocket
Dns_CreateMulticastSocket
Dns_CreateSocket
Dns_CreateSocketEx
Dns_ExtractRecordsFromMessage
Dns_FindAuthoritativeZoneLib
Dns_FreeMsgBuf
Dns_GetRandomXid
Dns_InitializeMsgBuf
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeWinsock
Dns_OpenTcpConnectionAndSend
Dns_ParseMessage
Dns_ParsePacketRecord
Dns_PingAdapterServers
Dns_ReadPacketName
Dns_ReadPacketNameAllocate
Dns_ReadRecordStructureFromPacket
Dns_RecvTcp
Dns_ResetNetworkInfo
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SetRecordDatalength
Dns_SetRecordsSection
Dns_SetRecordsTtl
Dns_SkipPacketName
Dns_SkipToRecord
Dns_UpdateLib
Dns_UpdateLibEx
Dns_WriteDottedNameToPacket
Dns_WriteQuestionToMessage
Dns_WriteRecordStructureToPacketEx
ExtraInfo_Init
Faz_AreServerListsInSameNameSpace
FlushDnsPolicyUnreachableStatus
GetCurrentTimeInSeconds
HostsFile_Close
HostsFile_Open
HostsFile_ReadLine
IpHelp_IsAddrOnLink
Local_GetRecordsForLocalName
Local_GetRecordsForLocalNameEx
NetInfo_Build
NetInfo_Clean
NetInfo_Copy
NetInfo_Free
NetInfo_GetAdapterByAddress
NetInfo_GetAdapterByInterfaceIndex
NetInfo_GetAdapterByName
NetInfo_IsAddrConfig
NetInfo_IsForUpdate
NetInfo_ResetServerPriorities
NetInfo_UpdateServerReachability
QueryDirectEx
Query_Main
Reg_FreeUpdateInfo
Reg_GetValueEx
Reg_ReadGlobalsEx
Reg_ReadUpdateInfo
Security_ContextListTimeout
Send_AndRecvUdpWithParam
Send_MessagePrivate
Send_OpenTcpConnectionAndSend
Socket_CacheCleanup
Socket_CacheInit
Socket_CleanupWinsock
Socket_ClearMessageSockets
Socket_CloseEx
Socket_CloseMessageSockets
Socket_Create
Socket_CreateMulticast
Socket_InitWinsock
Socket_JoinMulticast
Socket_RecvFrom
Socket_SetMulticastInterface
Socket_SetMulticastLoopBack
Socket_SetTtl
Socket_TcpListen
Trace_Reset
Update_ReplaceAddressRecordsW
Util_IsIp6Running

Sections

.text
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57f6880dcc4cd035d4551284e8c7e181

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

ws2_32

ntdll

nsi

api-ms-win-core-delayload-l1-1-0

kernelbase

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-1-0

Exports

Exports

Sections

.text Size: 242KB - Virtual size: 241KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 16KB - Virtual size: 16KB

.pdata Size: 17KB - Virtual size: 16KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 242KB - Virtual size: 241KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 16KB - Virtual size: 16KB

.pdata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 2KB - Virtual size: 1KB