43ce734d58e35d684d9184b1088461ea_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

43ce734d58e35d684d9184b1088461ea_JaffaCakes118
Size

214KB
MD5

43ce734d58e35d684d9184b1088461ea
SHA1

0c43140fb4a26f92b1cc3495b492fb7f2ff4fc43
SHA256

a215c8ee1d07c558cc65ea28ad5310504415834fed705871f284049c5aa5a2c8
SHA512

4f7ab28b67a36abeaf621db47a6dbd9f071c3bf4cbeb621b2e846e2df2d15c774249514b9a015801bafbaecf52e7f20224211aa668752874d1b323d24df7726c
SSDEEP

6144:Ijt0mA/MYCea2FZpmYaSPOOxw57Kyv/sv56cEi:A0mA/MYwnXWvEi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43ce734d58e35d684d9184b1088461ea_JaffaCakes118

Files

43ce734d58e35d684d9184b1088461ea_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3a5c8ed3eb81123fb6ae4dc22d9ae1ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

iswspace
wcscat
wcscpy
_wcsicmp
wcscmp
_purecall
_strupr
_except_handler3
_adjust_fdiv
malloc
_initterm
free
wcsncpy
wcslen
_wtoi
_wtol
wcschr
wcstok
_wcsupr
sprintf

ntdll

RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlSecondsSince1970ToTime

nwapi32

NwNdsReadAttrDef
NwNdsGetAttrListFromBuffer
NwNdsGetSyntaxID
NWPChangeObjectPasswordEncrypted
NWPGetChallengeKey
NwNdsChangeUserPassword
NwNdsConnHandleFree
NwNdsObjectHandleToConnHandle
NwNdsOpenObject
NwNdsCreateQueryNode
NwNdsDeleteQueryTree
NwNdsSearch
NwNdsGetAttrDefListFromBuffer
NwNdsReadClassDef
NwNdsRenameObject
NwNdsMoveObject
NwNdsPutInBuffer
NwNdsListSubObjects
NwNdsGetObjectListFromBuffer
NwNdsReadObject
NwNdsRemoveObject
NwNdsAddObject
NwNdsCreateBuffer
NwNdsModifyObject
NwNdsFreeBuffer
NwNdsCloseObject
NWCAttachToFileServerW
NWCDetachFromFileServer
NWCScanObject
NwNdsGetClassDefListFromBuffer

advapi32

SystemFunction041
SystemFunction040

nwprovau

NPOpenEnum

activeds

ord18
ord9
ord22
ord14
ord24
ord15
ord17
ord16
ord23
ord21
ord12

ole32

CoCreateInstance
StringFromGUID2
CreatePointerMoniker

winspool.drv

SetPrinterW
OpenPrinterW
ClosePrinter

kernel32

FormatMessageW
LocalFree
DisableThreadLibraryCalls
GetModuleHandleW
LocalAlloc
FileTimeToSystemTime
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
LocalFileTimeToFileTime
FileTimeToLocalFileTime
MultiByteToWideChar
GetSystemTime
LeaveCriticalSection
EnterCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
SystemTimeToFileTime

user32

wsprintfW
LoadStringW

oleaut32

SafeArrayPutElement
SafeArrayDestroy
VariantCopyInd
SysFreeString
VariantClear
SysAllocString
VariantCopy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
CreateErrorInfo
SetErrorInfo
SafeArrayCreate
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
VariantTimeToSystemTime
SystemTimeToVariantTime

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a5c8ed3eb81123fb6ae4dc22d9ae1ae

Headers

File Characteristics

Imports

msvcrt

ntdll

nwapi32

advapi32

nwprovau

activeds

ole32

winspool.drv

kernel32

user32

oleaut32

Exports

Exports

Sections

.text Size: 127KB - Virtual size: 126KB

.data Size: 73KB - Virtual size: 73KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 127KB - Virtual size: 126KB

.data
Size: 73KB - Virtual size: 73KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 7KB - Virtual size: 7KB