38b2c95d95aa45d76717c6993e9190ba_JaffaCakes118

General

Target

38b2c95d95aa45d76717c6993e9190ba_JaffaCakes118
Size

414KB
MD5

38b2c95d95aa45d76717c6993e9190ba
SHA1

dfe581293615dd6f10909d06e898d15008dabf17
SHA256

6e0c07f9c985ea3a7b52e9dcda8379bfd82b523140e703c343369370055a4bd0
SHA512

54839033dc057885572491c4aca7183ddfd6360d698ec63c5d61e7d9b270e1042775667e997d04b6b01c70afa15213af290e86267cebba290b63b754fb798626
SSDEEP

12288:2DsOSkpCtBayn5AY9sljV5FHk6D7bftZLQwvGC:2aMQ5P985fkU7bsF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38b2c95d95aa45d76717c6993e9190ba_JaffaCakes118

Files

38b2c95d95aa45d76717c6993e9190ba_JaffaCakes118
.dll windows:4 windows x86 arch:x86

043523b374b10c8109ff6b4bab052d0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnhandledExceptionFilter
GetCurrentProcess
DisableThreadLibraryCalls
GetCurrentProcessId
TerminateProcess
GetTickCount
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId

msvcrt

malloc
_except_handler3
free
_initterm
_adjust_fdiv

ntdll

NtAllocateVirtualMemory
LdrGetDllHandle
RtlLargeIntegerShiftRight

rpcrt4

NdrInterfacePointerBufferSize
CStdStubBuffer_DebugServerRelease
NdrPointerMarshall
NdrProxyInitialize
NdrAllocate
NdrDllCanUnloadNow
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrProxyFreeBuffer
CStdStubBuffer_IsIIDSupported
NdrInterfacePointerUnmarshall
CStdStubBuffer_CountRefs
NdrStubInitialize
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrProxyGetBuffer
NdrSimpleTypeMarshall
NdrStubGetBuffer
NdrProxyErrorHandler
NdrConvert
NdrStubForwardingFunction
NdrUserMarshalFree
NdrOleAllocate
NdrClearOutParameters
CStdStubBuffer_QueryInterface

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 928KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

043523b374b10c8109ff6b4bab052d0a

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

rpcrt4

Sections

.text Size: 6KB - Virtual size: 6KB

.reloc Size: 512B - Virtual size: 20B

.rdata Size: 53KB - Virtual size: 52KB

.rsrc Size: 288KB - Virtual size: 287KB

.data Size: 65KB - Virtual size: 928KB

.text
Size: 6KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 20B

.rdata
Size: 53KB - Virtual size: 52KB

.rsrc
Size: 288KB - Virtual size: 287KB

.data
Size: 65KB - Virtual size: 928KB