005efd5e1b16ff098b9986e8d75dd180_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

005efd5e1b16ff098b9986e8d75dd180_JaffaCakes118
Size

236KB
MD5

005efd5e1b16ff098b9986e8d75dd180
SHA1

1e9eb0c383b6e219d7d61aa4cf41c4103daad02e
SHA256

73cb227ae695e7f2b3d6b47b114128b593409070ded3bbd16befe84b6e97d9ec
SHA512

c3ce7ba9eba6d82036a4a23c76f6288b012065e77f85e6ee6ff4b7f902c12cdd4f0343f29b5c34d6f71094f77157bb38c1d4ff4b11f42601b52d6ebd2905a3b8
SSDEEP

6144:WfHxc3gL94Z0+gnyBb4WHvFriwFfXYBUzvcQi:WfHxc3+r+gyJ/trDfXSgcV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
005efd5e1b16ff098b9986e8d75dd180_JaffaCakes118

Files

005efd5e1b16ff098b9986e8d75dd180_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5339a7702d7147a480c38d6e05ce8a57

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
ReadFile
GetMailslotInfo
CreateMailslotW
LeaveCriticalSection
EnterCriticalSection
GetTickCount
OpenFileMappingW
HeapSize
GetProcessHeap
CreateProcessW
GetSystemDirectoryW
DeleteCriticalSection
InitializeCriticalSection
lstrcmpW
FreeLibrary
GetModuleHandleW
CreateMutexW
HeapFree
ProcessIdToSessionId
GetCurrentProcessId
GetVersionExW
lstrcpynW
GetProcAddress
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
lstrcatA
lstrcpyA
lstrlenA
IsDBCSLeadByte
LocalFree
LocalAlloc
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
GetLastError
UnmapViewOfFile
ReleaseMutex
WriteFile
WaitForSingleObject
TerminateThread
GetExitCodeThread
SetEvent
GetComputerNameW
GetACP
lstrcatW
Sleep
lstrlenW
lstrcmpiW
CreateThread
CreateEventW
CloseHandle
HeapAlloc
lstrcpyW

user32

PostMessageW
DefWindowProcW
PostQuitMessage
DispatchMessageW
TranslateMessage
CreateWindowExW
GetMessageW
RegisterClassW
CharNextW
wsprintfA
CharNextExA
ShowWindow
IsIconic
SendMessageW
GetWindowPlacement
wsprintfW
DestroyWindow
UnregisterClassW
KillTimer
IsWindowVisible
SetForegroundWindow
FindWindowW
SetTimer

winspool.drv

ClosePrinter
GetPrinterW
EnumPortsW
OpenPrinterW
GetPrinterDataW

advapi32

InitializeSid
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorDacl
AddAccessAllowedAce

rpcrt4

NdrPointerMarshall
RpcEpResolveBinding
RpcMgmtIsServerListening
RpcBindingFree
RpcNetworkIsProtseqValidW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
NdrFullPointerXlatInit
NdrConformantArrayBufferSize
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrPointerUnmarshall
NdrFullPointerXlatFree
RpcRaiseException
NdrClientInitializeNew
NdrConformantStringBufferSize
NdrGetBuffer
NdrFreeBuffer
NdrConvert
NdrSendReceive
NdrConformantStringMarshall

mpr

WNetGetConnectionW

wsock32

gethostbyname
gethostname
WSAStartup
WSACleanup

msvcrt

_except_handler3
wcsstr
wcscpy
wcsncpy
wcslen
malloc
free
wcsncmp

Exports

Exports

DllEntryPoint
SmPsw_ChangePrinterName
SmPsw_ClosePrinter
SmPsw_ClosePrinter2
SmPsw_DeviceRequest
SmPsw_DeviceRequest2
SmPsw_GetPrinterStatus
SmPsw_InvokePSW
SmPsw_JobRequest
SmPsw_OpenPrinter
SmPsw_OpenPrinter2
SmPsw_StartPolling
SmPsw_StopPolling
SmSpl_ClosePort
SmSpl_Init
SmSpl_OpenPrinter
SmSpl_Terminate

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5339a7702d7147a480c38d6e05ce8a57

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

rpcrt4

mpr

wsock32

msvcrt

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 176KB - Virtual size: 177KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 176KB - Virtual size: 177KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 4KB - Virtual size: 3KB