215ff8a66bc5f00db42f85eb41020b78_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

215ff8a66bc5f00db42f85eb41020b78_JaffaCakes118
Size

1.2MB
MD5

215ff8a66bc5f00db42f85eb41020b78
SHA1

fe980c602aa17e85a1ca46c22ccad7d769e0e7eb
SHA256

0d09b7dd82f4c3ba03ac523b20604fe388bae93e29e4f14ae1bcb8dcd98775dd
SHA512

58e3deb34c728318b62ffeb96f5fe1a7bf4f0acd013e4ef19008df9d634019eff8357d7e345253f111fb0e4c1df7982c7889d4c0aaf51efd1f7f82405c42cf58
SSDEEP

24576:BZOftiZTDiXUR0wfkEQwYc4RqfMIrCrAVvxzqLwj0VsIzpGT:BZOcna+kEbd3RxzqLwj0G8g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
215ff8a66bc5f00db42f85eb41020b78_JaffaCakes118

Files

215ff8a66bc5f00db42f85eb41020b78_JaffaCakes118
.exe windows:2 windows x86 arch:x86

6aaa68ea21220f3f2a6706b5c80cc604

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

TranslateMessage
SendMessageA
ShowWindow
BeginPaint
EndPaint
GetMessageA
DispatchMessageA
CreateWindowExA
UpdateWindow
DestroyWindow
RegisterClassA
DefWindowProcA

adsldpc

LdapDeleteExtS
LdapInitializeSearchPreferences
LdapSearch
SchemaGetClassInfo
LdapAddS
LdapReadAttribute2
LdapTypeToAdsTypeGeneralizedTime
FindEntryInSearchTable
ADSISetSearchPreference
BerBvFree
ADsEnumAttributes
ADSIExecuteSearch
ADSIFreeColumn
GetDisplayName
LdapSearchExtS
FreeADsStr
LdapParsePageControl
LdapGetNextPageS
ADSICloseSearchHandle
LdapNextAttribute
LdapGetSchemaObjectCount
LdapFirstAttribute
BuildADsPathFromLDAPPath2
ADSICreateDSObject
BuildLDAPPathFromADsPath2
ADsGetObjectAttributes
ReallocADsMem
SchemaGetPropertyInfo
ConvertSidToString
Component
LdapFirstEntry
ChangeSeparator
LdapSearchInitPage
FreeADsMem
ADsDeleteDSObject
ADsCreateDSObjectExt
LdapTypeFreeLdapModList
MapLDAPTypeToADSType
LdapControlFree
LdapReadAttribute
AllocADsStr
LdapModifyS
LdapTypeToAdsTypeCopyConstruct
ADsHelperGetCurrentRowMessage
ADSIAbandonSearch

kernel32

WaitForMultipleObjects
HeapDestroy
ReleaseMutex
VirtualFree
HeapLock
GetStringTypeExA
ConnectNamedPipe
GetLastError
HeapSetInformation
CreateFileA
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapUnlock
VirtualAlloc
GetSystemTimes
WaitNamedPipeA
GetSystemTime
lstrcmpiA
ExitProcess
GetEnvironmentStringsA
ReadFile
ReadFileScatter
GetProcessHeap
CloseHandle
CreateNamedPipeA
SetFilePointer
OpenMutexA
GetFileAttributesExA
FreeEnvironmentStringsA
IsBadStringPtrA
ExpandEnvironmentStringsA
GetNamedPipeHandleStateA
HeapCreate
HeapAlloc
CreateMutexA
InitializeCriticalSection

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6aaa68ea21220f3f2a6706b5c80cc604

Headers

DLL Characteristics

File Characteristics

Imports

user32

adsldpc

kernel32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 23KB

.rsrc Size: 19KB - Virtual size: 3.0MB

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 19KB - Virtual size: 3.0MB