5b42610ba5b28f661b7eb75160304ea1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5b42610ba5b28f661b7eb75160304ea1_JaffaCakes118
Size

422KB
MD5

5b42610ba5b28f661b7eb75160304ea1
SHA1

491024f000516d02bcf5d9e3726d8ae2256a26b6
SHA256

4264f605447bb545d92fc8b2771418c4976a486d232f2e0aef9793225db900b8
SHA512

b5a563577cc904387b85773422f68d804d2a6d407a2831dc4cd8939496ea411a552496070228637332d0eb761492c66c847615086664817afa1ec0686483953b
SSDEEP

12288:DBU94aHAAooUAtkiZX8/bl3/ldvHtTBWWs:FiAAptki+p3vvHDW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b42610ba5b28f661b7eb75160304ea1_JaffaCakes118

Files

5b42610ba5b28f661b7eb75160304ea1_JaffaCakes118
.dll windows:5 windows x86 arch:x86

63c180374ce1865596096bb748de9a88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

userenv

FreeGPOListW
CreateEnvironmentBlock
GetProfilesDirectoryW
RegisterGPNotification
UnregisterGPNotification
ExpandEnvironmentStringsForUserW

kernel32

VirtualAlloc
VirtualFree
VerifyVersionInfoW
VerLanguageNameW
VerLanguageNameA
CreateNamedPipeW
EndUpdateResourceW
EnumLanguageGroupLocalesA
EnumResourceLanguagesA
ExitProcess
FindVolumeClose
GetACP
GetAtomNameW
GetCPInfo
GetCommandLineA
GetDriveTypeA
GetPrivateProfileIntA
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetTimeZoneInformation
GlobalDeleteAtom
GlobalWire
HeapAlloc
IsDBCSLeadByte
OpenMutexA
QueueUserAPC
QueueUserWorkItem
RtlZeroMemory
SetCurrentDirectoryA
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
UnregisterWaitEx

crtdll

_memicmp
strspn
strcoll
ldiv
iswgraph
_mbsspnp
_mbcjistojms
_exit
_finite
_fpreset
_ismbcl1
_loaddll
_locking

ntdll

NtFreeUserPhysicalPages
RtlNtStatusToDosError
RtlValidRelativeSecurityDescriptor
ZwAlertResumeThread
ZwPowerInformation
RtlConvertUiListToApiList
NtSetInformationObject
NtRaiseException

rpcrt4

RpcSsFree
UuidFromStringA
char_from_ndr
short_from_ndr_temp
tree_into_ndr
RpcServerYield
CStdStubBuffer_CountRefs
RpcBindingReset
RpcServerRegisterIf
RpcServerUseAllProtseqsEx
RpcServerUseProtseqEpA

version

GetFileVersionInfoSizeA
VerInstallFileA
VerInstallFileW
VerQueryValueW
GetFileVersionInfoA

Exports

Exports

Ksdfhk
YsyirvzbBhwHLfg
bnrqgptuyvmz
cVgFzZkfnFzzJgjjS
eahiwdQ
ewV
kdv
njyvblrp
qdjzhwc
qdqfodryrp
rxsywzdbmtCuoljLaf
wbok
zxdhhqcsBfpkgz

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 362KB - Virtual size: 695KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63c180374ce1865596096bb748de9a88

Headers

DLL Characteristics

File Characteristics

Imports

userenv

kernel32

crtdll

ntdll

rpcrt4

version

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.data Size: 362KB - Virtual size: 695KB

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 32KB - Virtual size: 31KB

.data
Size: 362KB - Virtual size: 695KB

.rsrc
Size: 26KB - Virtual size: 26KB