944df2e380915d97a83280761288e733_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

944df2e380915d97a83280761288e733_JaffaCakes118
Size

19KB
MD5

944df2e380915d97a83280761288e733
SHA1

1e2cb4ac724f29aa24f7cce32b86f7abfd34bff5
SHA256

a662c5bb874edb65c7d3fc4942504ee1cbce259bc9b746649fbf613495d019ca
SHA512

68def166a94a3beb2048ac95329823d4b0142853f45843c058be4e6b2b7a0507f3ddd2940d96cde0d0607e8afee382c13be3adb98a0d4732cfb7c8fa89bb4d99
SSDEEP

384:2r4ZjPbU9ubqvxyFnldlZMOm9d81ncSFyMh/7vvxlLRrWBZW:1PB2vkhu9dincKyMh/7DRS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
944df2e380915d97a83280761288e733_JaffaCakes118

Files

944df2e380915d97a83280761288e733_JaffaCakes118
.dll regsvr32 windows:10 windows x86 arch:x86

940b589e3254b2c7cd0bffe1030d4dc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

msvcrt

free

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

ws2_32

WSACleanup

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-com-l1-1-0

CoUninitialize

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

ntdll

RtlMultiByteToUnicodeN

wbemcomn

RegisterDLL

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.MPRESS1
Size: 12KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

940b589e3254b2c7cd0bffe1030d4dc6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

ws2_32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

wbemcomn

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.MPRESS1 Size: 12KB - Virtual size: 48KB

.MPRESS2 Size: 5KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 980B

.MPRESS1
Size: 12KB - Virtual size: 48KB

.MPRESS2
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 980B