6f1c448095a11831dc6dc7e339aae828_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6f1c448095a11831dc6dc7e339aae828_JaffaCakes118
Size

44KB
MD5

6f1c448095a11831dc6dc7e339aae828
SHA1

64ad7f0a93a832d060472e395fe4fbe42c7c79c2
SHA256

7434aa2d3a082cd941a7e6c185c35212b879d97b935e2577bb7524d6181ea647
SHA512

64c9881696ecb043f12a4353df4af09cd1598d4bfc32570e12df6b37f63761258e30b34fff48b21f614370121488da098fb165a27aba2747355b0c8f8f0eb55b
SSDEEP

768:TE0TTEI+Ns8QsJGg3a/LJqaSqw+NN5ldOI9vu/FgbAyk+8x12l9X3ZGm:TE+Td+hsgq/L/VwqNsWq8b8ill3Zj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f1c448095a11831dc6dc7e339aae828_JaffaCakes118

Files

6f1c448095a11831dc6dc7e339aae828_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9c5575480f7d5f38319c5322c80ac5e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtInitializeRegistry
ZwDebugContinue
NtCreateSemaphore
NtExtendSection
ZwGetDevicePowerState
NtDeleteAtom
ZwDeleteKey
NtEnumerateValueKey
NtFsControlFile
NtOpenMutant
NtOpenEvent
NtFindAtom
NtImpersonateAnonymousToken
ZwOpenEventPair
NtOpenFile

kernel32

QueryPerformanceCounter
InterlockedIncrement
lstrcmpiW
InterlockedDecrement
GetVersionExA
CreateFileA
GetFileSize
GetPrivateProfileStructA
HeapAlloc
GetProcessHeap
FreeLibrary
GlobalAlloc
CreateSemaphoreA
lstrcpynW
GetTempFileNameW
WideCharToMultiByte
GetTempPathW
lstrcpynA
CloseHandle
GetProcessHeap
SetEndOfFile
SetCurrentDirectoryA
GetVersion
CreateEventA
VirtualAlloc
InterlockedIncrement
DuplicateHandle
MoveFileW

Exports

Exports

CreateProcessNotify
Icmp6ParseReplies
CreateIpForwardEntry
DllClientCleanup
net1etsh
DllClientStartup
CreateProxyArpEntry
GetOwnerModuleFromTcpEntry
Icmp6SendEcho2
InternalDeleteIpForwardEntry
NTTimeToNTPTime
IpReleaseAddress
AllocateAndGetIpAddrTableFromStack
GetOwnerModuleFromUdp6Entry
InternalDeleteIpNetEntry
DeleteProxyArpEntry
GetIpErrorString
DeleteIPAddress
AddIPAddress
GetTcpStatisticsEx
GetFriendlyIfIndex
InternalCreateIpNetEntry
GetIcmpStatistics
DeleteIpNetEntry
InternalSetIpStats
IcmpSendEcho
SetIpNetEntry
InternalGetIpForwardTable
GetIpStatistics
NotifyAddrChange
NhpAllocateAndGetInterfaceInfoFromStack
Icmp6CreateFile
GetIpNetTable
SetAdapterIpAddress
FlushIpNetTable
GetIpAddrTable
InternalGetTcpTable
SetTcpEntry
InternalGetIfTable
GetBestRoute
GetRTTAndHopCount
SetIpTTL
DeleteIpForwardEntry
InternalGetUdpTable
SendARP
NotifyRouteChange
GetIpStatisticsEx
InternalSetIfEntry
NhGetInterfaceNameFromDeviceGuid
SetIpForwardEntry
GetAdaptersInfo
InternalSetIpNetEntry
CancelIPChangeNotify
GetUdpStatistics
InternalGetIpNetTable
GetOwnerModuleFromUdpEntry
RestoreMediaSense
GetOwnerModuleFromTcp6Entry
GetTcpTable
GetExtendedUdpTable
UnenableRouter
InternalSetTcpEntry
GetIpForwardTable
register_icmp
GetAdaptersAddresses
GetIcmpStatisticsEx
GetBestInterface

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c5575480f7d5f38319c5322c80ac5e6

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 154B

.rsrc Size: 33KB - Virtual size: 36KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 154B

.rsrc
Size: 33KB - Virtual size: 36KB

.reloc
Size: 512B - Virtual size: 4KB