395a5d7bd4fdbd4bc1a138ca0a16743d_JaffaCakes118

General

Target

395a5d7bd4fdbd4bc1a138ca0a16743d_JaffaCakes118
Size

9KB
MD5

395a5d7bd4fdbd4bc1a138ca0a16743d
SHA1

cdb00055d4fa5fb9d7d01af64af46d24c2458bbb
SHA256

c7fb61fd83f7e209ce0e38c8d6482a96b73aa7c16e7efcc1a2abe5c90fe648f1
SHA512

a23c1da0b0d53179c0270516159e2b9d4a18c28e78d82a430d7cf92fc41aa1f9312f6a7addc55ba25f8e7b78e045b011dad5305b9d2fd6aa7f955ee7a7dc0591
SSDEEP

192:BJoIamBZJTiMgAErX3aOtGT6z2JaWOT/WW66:bvlilAs6OtG6WOT/WW66

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
395a5d7bd4fdbd4bc1a138ca0a16743d_JaffaCakes118

Files

395a5d7bd4fdbd4bc1a138ca0a16743d_JaffaCakes118
.dll windows:6 windows x86 arch:x86

705fb4b7b95340a6ee8e7ae9aa55d341

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

acproxy.pdb

Imports

msvcrt

_except_handler4_common
_XcptFilter
_amsg_exit
_initterm
free
malloc

ntdll

WinSqmIsOptedInEx
RtlFreeHeap
RtlAllocateHeap

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentProcess
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
GetTickCount
Sleep
GetLastError
CloseHandle
ReadFile
CreateFileW
FindVolumeClose
DeleteFileW
GetDriveTypeW
FindNextVolumeW
FindFirstVolumeW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource

ulib

??0DSTRING@@QAE@XZ
?UploadSqmFromFile@SQMEXPORT@@SGEPAX@Z
??1DSTRING@@UAE@XZ
??1HMEM@@UAE@XZ
??1OBJECT@@UAE@XZ
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Resize@HMEM@@QAEEKK@Z
?Initialize@FSTRING@@QAEPAVWSTRING@@PAGK@Z
?Acquire@HMEM@@UAEPAXKK@Z
?Initialize@HMEM@@QAEEXZ
??0FSTRING@@QAE@XZ
??0HMEM@@QAE@XZ

Exports

Exports

PerformAutochkOperations

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

705fb4b7b95340a6ee8e7ae9aa55d341

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ulib

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 844B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 470B

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 844B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 470B