0d982e3670e8622b680aaba0d6dae9a8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0d982e3670e8622b680aaba0d6dae9a8_JaffaCakes118
Size

151KB
MD5

0d982e3670e8622b680aaba0d6dae9a8
SHA1

661f8b0cb7642ff755bb60bc83a07132237f494d
SHA256

ad4dc4a2787b38c97676e7266848cfaaf67821a6e504a3bc6d568e2a5cb8265e
SHA512

4d52db5483f54eb521ca8e0480bee53d7cdd3bafbc9c2ae62e404adc5de6eb785b46724a6c83665aa84bdd101affce4ab052d99bd01cb5844440fd59e6d73224
SSDEEP

3072:opLOyy2RTJkpalzbEM7u6tDmOUtAlZvOE2C+wzEUmJIkSoHE:eOGK4Bbt6aqOUtA/O5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d982e3670e8622b680aaba0d6dae9a8_JaffaCakes118

Files

0d982e3670e8622b680aaba0d6dae9a8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6fa05dc6210113a363881a827b52b95a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

NdrSimpleStructBufferSize
NdrInterfacePointerMarshall
NdrPointerMarshall
NdrUserMarshalUnmarshall
NdrAllocate
CStdStubBuffer_Invoke
NdrSimpleTypeMarshall
NdrConformantStringUnmarshall
CStdStubBuffer_DebugServerQueryInterface
NdrProxyInitialize
NdrPointerUnmarshall
NdrProxyFreeBuffer
NdrDllCanUnloadNow
NdrUserMarshalBufferSize
NdrCStdStubBuffer_Release
NdrConformantStringMarshall
NdrPointerBufferSize
NdrProxyErrorHandler
NdrSimpleStructMarshall
NdrDllUnregisterProxy
NdrDllRegisterProxy
CStdStubBuffer_CountRefs
NdrOleFree
IUnknown_Release_Proxy
NdrUserMarshalMarshall
NdrPointerFree
CStdStubBuffer_Disconnect
NdrSimpleTypeUnmarshall
NdrStubCall2
CStdStubBuffer_IsIIDSupported
NdrConformantStringBufferSize
NdrConformantArrayBufferSize
RpcRaiseException
CStdStubBuffer_AddRef
NdrOleAllocate
NdrStubGetBuffer
NdrInterfacePointerUnmarshall
NdrClearOutParameters
IUnknown_QueryInterface_Proxy
NdrUserMarshalFree
IUnknown_AddRef_Proxy
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrCStdStubBuffer2_Release
NdrConformantArrayMarshall
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
CStdStubBuffer_DebugServerRelease
NdrConvert
NdrProxyGetBuffer
NdrProxySendReceive
NdrSimpleStructUnmarshall
CStdStubBuffer_Connect
NdrDllGetClassObject
NdrStubInitialize
NdrConformantArrayUnmarshall

ntdll

NtAllocateVirtualMemory
RtlUshortByteSwap
LdrGetDllHandle

kernel32

QueryPerformanceCounter
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetCurrentProcess
GetTickCount
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcrt

_except_handler3
_adjust_fdiv
malloc
free
_initterm

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6fa05dc6210113a363881a827b52b95a

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

ntdll

kernel32

msvcrt

Sections

.text Size: 5KB - Virtual size: 4KB

.rsrc Size: 14KB - Virtual size: 14KB

.data Size: 66KB - Virtual size: 352KB

.reloc Size: 512B - Virtual size: 24B

.rdata Size: 64KB - Virtual size: 63KB

.text
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 14KB - Virtual size: 14KB

.data
Size: 66KB - Virtual size: 352KB

.reloc
Size: 512B - Virtual size: 24B

.rdata
Size: 64KB - Virtual size: 63KB