23947bc84a18711e8c49721bd20f78d8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

23947bc84a18711e8c49721bd20f78d8_JaffaCakes118
Size

86KB
MD5

23947bc84a18711e8c49721bd20f78d8
SHA1

1717374da3a90c162e8085e56d351309af616ec1
SHA256

b379d68ecb5265b2382b6d422e48a554d49e26366b1aa8a4d51da84c7bbab823
SHA512

a89397549e4e50233e88b04a48ecd59a1a874f9e25cdeea00d22ada5787756cc60d27da9f0556635856426c22f5041b4c9e8cfdd6d41d55922744441183194ee
SSDEEP

384:I9Sb3SfpSwwEGd3SwwE+/qljOA/LauE0eR7jttIj7/G92IGeWfiYE4zhl1NBS8h7:I9SOfpSwk3SwgrrNjttaeA9zZNwM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23947bc84a18711e8c49721bd20f78d8_JaffaCakes118

Files

23947bc84a18711e8c49721bd20f78d8_JaffaCakes118
.dll windows:4 windows x86 arch:x86

20875cf3f33a4216400acfcbd0d7d212

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapReAlloc
RaiseException

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_strdup
free
fwrite
getenv
memcmp
memmove
strchr
strcmp
strcpy
strcspn
strlen

Exports

Exports

LsAppendRunToCurrentSubline
LsCompressSubline
LsCreateContext
LsCreateLine
LsCreateSubline
LsDestroyContext
LsDestroyLine
LsDestroySubline
LsDisplayLine
LsDisplaySubline
LsEnumLine
LsEnumSubline
LsExpandSubline
LsFetchAppendToCurrentSubline
LsFetchAppendToCurrentSublineResume
LsFindNextBreakSubline
LsFindPrevBreakSubline
LsFinishCurrentSubline
LsForceBreakSubline
LsGetHihLsimethods
LsGetLineDur
LsGetMinDurBreaks
LsGetReverseLsimethods
LsGetRubyLsimethods
LsGetSpecialEffectsSubline
LsGetTatenakayokoLsimethods
LsGetWarichuLsimethods
LsLwMultDivR
LsMatchPresSubline
LsModifyLineHeight
LsPointUV2FromPointUV1
LsPointXYFromPointUV
LsQueryCpPpointSubline
LsQueryFLineEmpty
LsQueryLineCpPpoint
LsQueryLineDup
LsQueryLinePointPcp
LsQueryPointPcpSubline
LsQueryTextCellDetails
LsResetRMInCurrentSubline
LsSetBreakSubline
LsSetBreaking
LsSetCompression
LsSetDoc
LsSetExpansion
LsSetModWidthPairs
LsSqueezeSubline
LsTruncateSubline
LsdnDistribute
LsdnFinishByOneChar
LsdnFinishByPen
LsdnFinishBySubline
LsdnFinishDelete
LsdnFinishDeleteAll
LsdnFinishRegular
LsdnFinishRegularAddAdvancePen
LsdnGetCurTabInfo
LsdnGetDup
LsdnGetFormatDepth
LsdnModifyParaEnding
LsdnQueryObjDimRange
LsdnQueryPenNode
LsdnResetObjDim
LsdnResetPenNode
LsdnResolvePrevTab
LsdnSetAbsBaseLine
LsdnSetRigidDup
LsdnSkipCurTab
LsdnSubmitSublines
LssbFDoneDisplay
LssbFDonePresSubline
LssbFIsSublineEmpty
LssbGetDupSubline
LssbGetDurTrailInSubline
LssbGetDurTrailWithPensInSubline
LssbGetNumberDnodesInSubline
LssbGetObjDimSubline
LssbGetPlsrunsFromSubline
LssbGetVisibleDcpInSubline

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 160B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 4KB - Virtual size: 31B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20875cf3f33a4216400acfcbd0d7d212

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

ucrtbase

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 56B

.rodata Size: 4KB - Virtual size: 1KB

.rdata Size: 4KB - Virtual size: 328B

/4 Size: 4KB - Virtual size: 808B

.bss Size: - Virtual size: 160B

.edata Size: 8KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 692B

.reloc Size: 4KB - Virtual size: 568B

/14 Size: 4KB - Virtual size: 128B

/29 Size: 8KB - Virtual size: 7KB

/41 Size: 4KB - Virtual size: 1KB

/55 Size: 4KB - Virtual size: 2KB

/67 Size: 4KB - Virtual size: 31B

/78 Size: 4KB - Virtual size: 3KB

.text
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 56B

.rodata
Size: 4KB - Virtual size: 1KB

.rdata
Size: 4KB - Virtual size: 328B

/4
Size: 4KB - Virtual size: 808B

.bss
Size: - Virtual size: 160B

.edata
Size: 8KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 692B

.reloc
Size: 4KB - Virtual size: 568B

/14
Size: 4KB - Virtual size: 128B

/29
Size: 8KB - Virtual size: 7KB

/41
Size: 4KB - Virtual size: 1KB

/55
Size: 4KB - Virtual size: 2KB

/67
Size: 4KB - Virtual size: 31B

/78
Size: 4KB - Virtual size: 3KB