3aac08151791b63f6bdddc69114e4e7b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3aac08151791b63f6bdddc69114e4e7b_JaffaCakes118
Size

415KB
MD5

3aac08151791b63f6bdddc69114e4e7b
SHA1

9165070824985f7b52d6d7c3833fffe812985bc5
SHA256

d7c389765b090c0858663786eed2fd90a663f67fff90d5324b30fb999384320b
SHA512

79b80c85abfb34bb00e4cb1f6d50405d1f66805a87fc87d600c8112f96111edb6c8510a52f093ffce6f48efe30c3fa94039c20f3c61cece701f04f6bf05a1a2d
SSDEEP

12288:JoOltQhGDEoY08N9A7RTAozuqBFS0YXg5oZpN6:WOldDEoJ8071AcYw56pN6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3aac08151791b63f6bdddc69114e4e7b_JaffaCakes118

Files

3aac08151791b63f6bdddc69114e4e7b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d7ca25a5eb3ef73ac99d488a18f5b907

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rpcrt4

NdrSimpleTypeMarshall
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrUserMarshalBufferSize
NdrProxyGetBuffer
NdrConformantArrayUnmarshall
NdrProxyInitialize
NdrConformantStringBufferSize
NdrOleAllocate
NdrInterfacePointerUnmarshall
CStdStubBuffer_Disconnect
NdrConvert
NdrSimpleStructUnmarshall
NdrPointerMarshall
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrConformantArrayMarshall
NdrConformantStringMarshall
NdrSimpleTypeUnmarshall
NdrDllGetClassObject
NdrConformantArrayBufferSize
NdrUserMarshalMarshall
CStdStubBuffer_IsIIDSupported
NdrSimpleStructMarshall
NdrClearOutParameters
NdrStubCall2
NdrProxySendReceive
NdrUserMarshalUnmarshall
CStdStubBuffer_DebugServerQueryInterface
NdrStubForwardingFunction
NdrAllocate
RpcRaiseException
NdrPointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerBufferSize
NdrProxyFreeBuffer
NdrPointerUnmarshall
NdrDllUnregisterProxy
NdrUserMarshalFree
NdrStubGetBuffer
IUnknown_AddRef_Proxy
NdrSimpleStructBufferSize
NdrConformantStringUnmarshall
NdrInterfacePointerFree
IUnknown_Release_Proxy
NdrProxyErrorHandler
NdrDllCanUnloadNow
NdrStubInitialize
CStdStubBuffer_AddRef
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Connect
NdrOleFree
NdrPointerBufferSize
IUnknown_QueryInterface_Proxy

msvcrt

_except_handler3
_initterm
malloc
free
_adjust_fdiv

ntdll

RtlLargeIntegerShiftLeft
NtAllocateVirtualMemory
LdrGetDllHandle

kernel32

GetTickCount
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
UnhandledExceptionFilter
TerminateProcess
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcess

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 333KB - Virtual size: 928KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7ca25a5eb3ef73ac99d488a18f5b907

Headers

File Characteristics

Imports

rpcrt4

msvcrt

ntdll

kernel32

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 333KB - Virtual size: 928KB

.rdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 333KB - Virtual size: 928KB

.rdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 512B - Virtual size: 20B