3976978914881dce23c18d6db070e3f7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3976978914881dce23c18d6db070e3f7_JaffaCakes118
Size

44KB
MD5

3976978914881dce23c18d6db070e3f7
SHA1

dc5c63e7558f89324cef8fe0a4906d19a78395d0
SHA256

29070d97fe04546c6f2607ac7b43e3b4926f1b1e2bc9437cd38f56a62ffa527f
SHA512

60ebcd71e12361fe43436bd6befe6942ca5eecc723d72ea13d74f5295c2061cb503b70bc5e52029cb8ccb82ff15e6517e201efe2d39f3e01d5a3de88fe4aea4e
SSDEEP

768:t5EEFKpcpxuN3cChQCgkNWlJ8R2tGWTWFJal17wM/JNpu4yO1509G:0dp4xuMFljE2tGUsikucxyy9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3976978914881dce23c18d6db070e3f7_JaffaCakes118

Files

3976978914881dce23c18d6db070e3f7_JaffaCakes118
.dll windows:5 windows x86 arch:x86

425f8dcf5f5c64eeb40c4b8dd023f6f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtFsControlFile
ZwDeleteFile
ZwGetPlugPlayEvent
NtCreateSymbolicLinkObject
ZwIsProcessInJob
ZwOpenKeyedEvent
NtFindAtom
ZwOpenKey
NtExtendSection
ZwDebugActiveProcess
NtOpenEvent

kernel32

CreateFileMappingA
GlobalDeleteAtom
GetSystemTime
lstrlenW
GetEnvironmentVariableW
MoveFileExW
VirtualAlloc
TerminateProcess
SystemTimeToFileTime
CreateProcessA
GetSystemTimeAsFileTime
GetExitCodeThread
CreateSemaphoreA
GetLastError
LoadLibraryA
SetFilePointer
CloseHandle
WritePrivateProfileStringA
FindFirstFileA
GetFullPathNameW
SetEndOfFile
SetThreadPriority
WriteFile
GetModuleFileNameA
GetShortPathNameA
CreateFileA
LocalAlloc
OutputDebugStringA
InterlockedDecrement
GetCommandLineW

Exports

Exports

CreateIpForwardEntry
GetIcmpStatisticsEx
CreateProcessNotify
DllClientCleanup
GetUniDirectionalAdapterInfo
EmsStvol
DllClientStartup
GetOwnerModuleFromUdp6Entry
GetIfTable
InternalGetTcpTable
GetInterfaceInfo
InternalDeleteIpForwardEntry
SetIpTTL
DeleteIpForwardEntry
GetNumberOfInterfaces
DeleteIpNetEntry
IcmpCreateFile
IcmpSendEcho
EnableRouter
FlushIpNetTable
CreateIpNetEntry
GetPerAdapterInfo
GetExtendedUdpTable
IcmpParseReplies
GetBestInterface
SetIpNetEntry
GetTcpTable
GetIcmpStatistics
GetExtendedTcpTable
SetTcpEntry
GetUdpTable
UnenableRouter
AllocateAndGetIpAddrTableFromStack
NhpAllocateAndGetInterfaceInfoFromStack
NTPTimeToNTFileTime
GetUdpStatistics
GetIpAddrTable
InternalSetIpStats
GetOwnerModuleFromTcp6Entry
GetAdapterOrderMap
InternalSetIpForwardEntry
InternalGetUdpTable
NhGetInterfaceNameFromDeviceGuid
do_echo_rep
GetFriendlyIfIndex
SetAdapterIpAddress
GetOwnerModuleFromTcpEntry

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

425f8dcf5f5c64eeb40c4b8dd023f6f5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 139B

.rsrc Size: 33KB - Virtual size: 36KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 139B

.rsrc
Size: 33KB - Virtual size: 36KB

.reloc
Size: 512B - Virtual size: 4KB