8276c60465f517312d40cd0230a99fa8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8276c60465f517312d40cd0230a99fa8_JaffaCakes118
Size

44KB
MD5

8276c60465f517312d40cd0230a99fa8
SHA1

902e9d6c86af1e7e34fdaecbc973e83f1019092c
SHA256

8ffa4d8a788e32a62364481f7ffbd97375006c173a71be132e6561e8472834d2
SHA512

8928cfad935f5c56a804a536523a69fda670479dc787fb61ddf9138113575958c25c222e188c5042167e99620d56978748b7b2c1cb998a54cce252bd633604fd
SSDEEP

768:9GkF7/tRg4Ypu0jZa7/GCNH0HYODFSE5+lE3dj+sP7wxXGAPM6ES77DrDf:LpRpYcSY7u64FSxlyd6s0Ayr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8276c60465f517312d40cd0230a99fa8_JaffaCakes118

Files

8276c60465f517312d40cd0230a99fa8_JaffaCakes118
.dll windows:6 windows x86 arch:x86

894e5d4aaa6a098c923a818ff40d2719

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

ntdll

memset

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken

api-ms-win-security-base-l1-1-0

PrivilegeCheck

Exports

Exports

BCryptAddContextFunction
BCryptAddContextFunctionProvider
BCryptCloseAlgorithmProvider
BCryptConfigureContext
BCryptConfigureContextFunction
BCryptCreateContext
BCryptCreateHash
BCryptDecrypt
BCryptDeleteContext
BCryptDeriveKey
BCryptDeriveKeyCapi
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptDuplicateHash
BCryptDuplicateKey
BCryptEncrypt
BCryptEnumAlgorithms
BCryptEnumContextFunctionProviders
BCryptEnumContextFunctions
BCryptEnumContexts
BCryptEnumProviders
BCryptEnumRegisteredProviders
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptFreeBuffer
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptGetFipsAlgorithmMode
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptQueryContextConfiguration
BCryptQueryContextFunctionConfiguration
BCryptQueryContextFunctionProperty
BCryptQueryProviderRegistration
BCryptRegisterConfigChangeNotify
BCryptRegisterProvider
BCryptRemoveContextFunction
BCryptRemoveContextFunctionProvider
BCryptResolveProviders
BCryptSecretAgreement
BCryptSetAuditingInterface
BCryptSetContextFunctionProperty
BCryptSetProperty
BCryptSignHash
BCryptUnregisterConfigChangeNotify
BCryptUnregisterProvider
BCryptVerifySignature

Sections

.MPRESS1
Size: 36KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

894e5d4aaa6a098c923a818ff40d2719

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.MPRESS1 Size: 36KB - Virtual size: 88KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.MPRESS1
Size: 36KB - Virtual size: 88KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB