30535813281e0bd5305b8ab819d56199_JaffaCakes118

General

Target

30535813281e0bd5305b8ab819d56199_JaffaCakes118
Size

43KB
MD5

30535813281e0bd5305b8ab819d56199
SHA1

d6e422b02b445f2d0268bfb40b67a63fb7e15665
SHA256

38a2c14f658c3d7f7782d5af8ce16190accd52057e4abd1d0daf270b45f490ea
SHA512

a616deb4e3da65bb680ee36b3e558c94d83e1360628be441651aeaf20091509188ad60ae03978cbc46dde3f7d9e2755038a1ea42677fa11c1a137c899cad666f
SSDEEP

768:L3faDf7VLc5Y7OeUiTvPQuRTb8B/QE3xM2VuVMkr/iS:L3SHVLcAVTvPEBo9N/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30535813281e0bd5305b8ab819d56199_JaffaCakes118

Files

30535813281e0bd5305b8ab819d56199_JaffaCakes118
.dll windows:5 windows x86 arch:x86

758a55490b9e73a54e5070454a913709

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwOpenEvent
NtGetContextThread
NtInitiatePowerAction
NtDeleteObjectAuditAlarm
NtCreateSemaphore
NtOpenEventPair
ZwDeleteFile
NtImpersonateClientOfPort

kernel32

LoadLibraryW
GetFileSize
GetTickCount
QueueUserAPC
CopyFileW
GetFullPathNameW
GetLocaleInfoW
MultiByteToWideChar
CreateWaitableTimerA
InterlockedExchangeAdd
FindResourceExW
GetProcessHeap
TlsAlloc
GetCurrentThreadId
GetVersion
OutputDebugStringA
GetTempFileNameW
LeaveCriticalSection
ReleaseSemaphore
HeapFree
CreateThread
GetLocalTime
SetCurrentDirectoryW
GetModuleFileNameA
CreateDirectoryW
GetSystemDirectoryW
GetExitCodeThread
lstrcmpW
SetFilePointer
CloseHandle
VirtualAlloc
Sleep
WritePrivateProfileSectionW
TlsSetValue

Exports

Exports

CreateProcessNotify
InternalCreateIpForwardEntry
DllClientCleanup
finddown
GetIfTable
DllClientStartup
InternalCreateIpNetEntry
GetTcpStatistics
Icmp6CreateFile
GetNumberOfInterfaces
GetUniDirectionalAdapterInfo
GetIcmpStatisticsEx
GetUdpStatisticsEx
GetNetworkParams
IpRenewAddress
InternalSetIfEntry
DeleteIpNetEntry
SendARP
NotifyAddrChange
GetTcpTable
GetTcpStatisticsEx
CreateProxyArpEntry
GetOwnerModuleFromUdp6Entry
GetPerAdapterInfo
IpReleaseAddress
DeleteIpForwardEntry
InternalGetIpAddrTable

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 91B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

758a55490b9e73a54e5070454a913709

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 91B

.rsrc Size: 33KB - Virtual size: 36KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 91B

.rsrc
Size: 33KB - Virtual size: 36KB

.reloc
Size: 512B - Virtual size: 4KB