67a604d24c2478b19d80032dbc5a3d41_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

67a604d24c2478b19d80032dbc5a3d41_JaffaCakes118
Size

92KB
MD5

67a604d24c2478b19d80032dbc5a3d41
SHA1

52caa1d3061ee69bd51d235dfd88a52872fae5fa
SHA256

3aad76afcc5d9d5629cb512ca3f8c500fa381231bf15d51b797e30768d5e0e78
SHA512

e27a9b1ff29e369d2c0b3227da8ea33acfdd8dc3db7e4c2c41ef5396f606c797ec975f7a5f5c4db0daa579d290b45d0cf8fe386d8c349850037b1a9048dd9eec
SSDEEP

1536:3lWDGYdc9jZ5xqC75DvSYRAPKl6l6w/093JfiHsWCznd09dlgDSBQok:VIGYdc9Tx/7tvkPnYwcppiU5Ma0Zk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67a604d24c2478b19d80032dbc5a3d41_JaffaCakes118

Files

67a604d24c2478b19d80032dbc5a3d41_JaffaCakes118
.dll windows:6 windows x64 arch:x64

72d29ba1c2e9e234ec6fdee41def0e02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

inet_pton
WSACleanup
WSAStartup
socket
send
recv
htons
connect

kernel32

WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
WriteConsoleW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
CreateRemoteThread
GetConsoleCP
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
GlobalAlloc
lstrcmpiA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetProcessId
TlsFree
CreateFileW
SetFilePointerEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
GetFileType
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetConsoleMode

advapi32

OpenProcessToken

ntdll

RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

ReflectiveLoader

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72d29ba1c2e9e234ec6fdee41def0e02

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

advapi32

ntdll

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 2KB - Virtual size: 1KB