21d917d87b7c66a62842f4bd2241b1c1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

21d917d87b7c66a62842f4bd2241b1c1_JaffaCakes118
Size

111KB
MD5

21d917d87b7c66a62842f4bd2241b1c1
SHA1

81b8553b4fe25495bd196e9c0619fc9afdfd0d90
SHA256

38fc9198a97ec5b5da9dccc9e055f2ff8d49c19afd888e5cf38d31551a66df90
SHA512

53a71ffcabcfe4bb31cd1a2224bcc9e5d35f74f32c609d43c417607aa2283c4fdf37bbeecf1c3fe191f9357d8063ce5db65812a8fad235687e76a393712b118e
SSDEEP

3072:ZKU2omRT2pEdQTRDA/ExIF080i+1o7LK4XN:ZKro+TQEd8F6AIu80ikiF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21d917d87b7c66a62842f4bd2241b1c1_JaffaCakes118

Files

21d917d87b7c66a62842f4bd2241b1c1_JaffaCakes118
.dll windows:6 windows x64 arch:x64

bb4140be27185633d225a477ef8dc4fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
CloseHandle
OutputDebugStringA
VirtualAlloc
GetModuleFileNameW
ReadFile
FreeConsole
WideCharToMultiByte
VirtualQuery
GetFileSize
CreateFileA
WriteConsoleW
SetFilePointerEx
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
HeapSize
HeapFree
HeapAlloc
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
WriteFile
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
LCMapStringW
OutputDebugStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW

advapi32

RegCloseKey
ControlService
RegisterServiceCtrlHandlerW
RegOpenKeyExW
SetServiceStatus
RegDeleteValueW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shlwapi

PathRemoveFileSpecA

Exports

Exports

ServiceMain
UninstallSvc

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb4140be27185633d225a477ef8dc4fd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 7KB - Virtual size: 15KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 7KB - Virtual size: 15KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB