5c0af1a4234488a74c95cc4567d65aa8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5c0af1a4234488a74c95cc4567d65aa8_JaffaCakes118
Size

212KB
MD5

5c0af1a4234488a74c95cc4567d65aa8
SHA1

7e40686c0553da75054bd610d1792d903f7ea45d
SHA256

96d91da4d781d9c66c76997168bc483c87451989761fc12175dc0e0d18fef7c6
SHA512

038f22f23ec88313bd382fbbfbf82c662634c8da5af1aed47fc1b0d8526f82713904476ede5b0202e7ca37af2fbce108c404af5673bcb6b4957c0ec34144baf6
SSDEEP

6144:92XM6WtvWyB783/XhmHD8u/KLAj8BxTz+hMt:IlWtZB78pmH4RRz66

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c0af1a4234488a74c95cc4567d65aa8_JaffaCakes118

Files

5c0af1a4234488a74c95cc4567d65aa8_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

b05588809daad5ddc96de517658ad4d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\MN1\Bld\Sources\Monitors\src\TRANSPORT\TRANSDLL\obj\fre\W2K\i386\TRANSPORT.pdb

Imports

kernel32

DisableThreadLibraryCalls
lstrlenW
lstrcatW
lstrcpyW
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW

ole32

CoInitialize
CoInitializeSecurity
CoCreateInstanceEx
CoCreateInstance
CoUninitialize

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen

ntdll

RtlUnwind

Exports

Exports

DllRegisterServer
DllUnregisterServer
Transport_AddMessage
Transport_Connect
Transport_DidConnectionFail
Transport_Disconnect
Transport_PostJobInfoMessage
Transport_ReadMessage
Transport_SendMessage

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 178KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b05588809daad5ddc96de517658ad4d3

Headers

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

ntdll

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.data Size: 178KB - Virtual size: 180KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 27KB

.data
Size: 178KB - Virtual size: 180KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 3KB - Virtual size: 3KB