08cf1013c2f014b61474bbac571f633e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

08cf1013c2f014b61474bbac571f633e_JaffaCakes118
Size

87KB
MD5

08cf1013c2f014b61474bbac571f633e
SHA1

b1ce987ada4e81e9f381a9a01808c98e10e2a925
SHA256

f1205b7e65d710fe471e3040748db10907025c2ad7792a2c597641f55de0e637
SHA512

2843bc78d7a51a5d695ddd7c538b571d06746f1d59bb65f39ab0f6bfa6f5ee316354c2c3c4e6e7e0af336d85086d5d08a9af7b9ff606ca757fadf900a9eb5d00
SSDEEP

1536:N1DagujKH35Z+/R7W2rnlqFFKeVUQaZ/CGD/t36gyhnIifn+bNb7D4lp5emVL5zk:Np3ujIS/R7js3B3+HKgyScq1X4luGLdk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08cf1013c2f014b61474bbac571f633e_JaffaCakes118

Files

08cf1013c2f014b61474bbac571f633e_JaffaCakes118
.dll windows:5 windows x86 arch:x86

40aa4939574f5a87ae20b48ee99129a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

RtlCompareUnicodeString
RtlExitUserThread
RtlFillMemory
NtQueryInformationFile
ZwSetEvent
NtOpenTimer

apcuhost

SetResourceServiceEnvironment
IsResourceClassEqual
GetDwordValue
GetBinaryValue
SetPropertyParameterBlock
FindDwordProperty
EnumResources
FreeEnvironment
PropertyListFromParameterBlock
VerifyResourceService
FindExpandedSzProperty
GetResourceNameDependency
GetMultiSzProperty
FindBinaryProperty

kernel32

GetCurrentThreadId
GetUserDefaultLCID
InterlockedDecrement
GetStringTypeA
VirtualFree
IsBadWritePtr
GetSystemDefaultLangID
GetProfileStringA
GetTimeFormatA
SetCurrentDirectoryW
UnhandledExceptionFilter
CreateThread
LoadResource
VirtualAlloc
GetFileType
SetFileTime
LCMapStringA
InitializeCriticalSection
ResumeThread
TlsSetValue
GetProcAddress
VirtualAlloc
LocalFree
GetFileAttributesW
GetVersionExA
HeapCreate
GlobalAlloc
LoadLibraryW
GetEnvironmentStringsW
FindResourceA
GetCurrentThread
GlobalGetAtomNameA
ResetEvent
OutputDebugStringA
GetStdHandle
GetCurrentDirectoryW
DeleteCriticalSection
lstrlenA
CloseHandle
HeapSize
GetCommandLineA

Exports

Exports

CreateProcessNotify
CreateOverStructPool
CreateUnimodemTimer
QueryApplication
OpenComponentLibraryEx
UmPlatformDeinitialize
OpenComponentLibraryOnMemEx
ExecuteAction
SetActionLogModeSz
RegisterApplication
OpenComponentLibraryOnStreamEx
SetSilent
SetActionLogFile
InprocServer32FromString
FreeUnimodemTimer
StopMonitoringHandle
AppRegEnum
GetComputerObject
StartMonitorThread
MonitorHandle
GetGlobalBabyJITEnabled
ReinitOverStruct
ResetCallCount
SetActionLogMode
UpdateFromAppChange
DowngradeAPL
GetSimpleTableDispenser
StopMonitorThread
CloseAppRegEnum
SetupSave

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40aa4939574f5a87ae20b48ee99129a7

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

apcuhost

kernel32

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 70KB

.data Size: 14KB - Virtual size: 14KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 70KB - Virtual size: 70KB

.data
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB