0b773099c5d36d00fe76b161c9be236a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b773099c5d36d00fe76b161c9be236a_JaffaCakes118
Size

13KB
MD5

0b773099c5d36d00fe76b161c9be236a
SHA1

9bed3c338431dd1ade84d21323e68a8a7b9d916c
SHA256

bd1271630573bf1ed0a1ea7323cc21deca3bb90771b6af5d1156649ceb03f2d3
SHA512

caf5ea6a82836b6d41d04dd642d674bbb110264cb2cfbcc11c5aecbe238476d7b9131b3343d286637f2a6304fce7b6beb761359c068fa3b3c0ac1cf1d08528ae
SSDEEP

192:8BLKKb8qerO5w87FP2c0L/N8uogIxgQWAoYWsWb:qKKb8qey5w4IKgISQWAoYWP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b773099c5d36d00fe76b161c9be236a_JaffaCakes118

Files

0b773099c5d36d00fe76b161c9be236a_JaffaCakes118
.dll windows:6 windows x86 arch:x86

6cc015b76aef262e4ac75668de2a98f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rasadhlp.pdb

Imports

msvcrt

memcpy
memset
_except_handler4_common
_strlwr
_XcptFilter
malloc
free
_initterm
_amsg_exit

ntdll

NtCreateFile
RtlInitUnicodeString
NtDeviceIoControlFile

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExA
GetProcAddress
LoadLibraryExW

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-misc-l1-1-0

LocalFree
LocalAlloc
Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AcsHlpNbConnection
WSAttemptAutodialAddr
WSAttemptAutodialName
WSNoteSuccessfulHostentLookup

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.texc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6cc015b76aef262e4ac75668de2a98f7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.texc Size: 2KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

.texc
Size: 2KB - Virtual size: 4KB