76fe5a612d0edf89ae2ef05a590c99ed_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76fe5a612d0edf89ae2ef05a590c99ed_JaffaCakes118
Size

88KB
MD5

76fe5a612d0edf89ae2ef05a590c99ed
SHA1

2fff55adf72279ec1303e76502f1f410b6a11be9
SHA256

71471c5a16f8a93c7b44832532888208d439973c19dd4772e2019259cc825690
SHA512

cd1ed1295ea1e25500e501b0c06b75f556ca112318f269e7ff249c5c0fee9325e0f5b1874253830ec528f536da1cdc4af1df3c035ddcc0663cb4362d3ae2001a
SSDEEP

1536:eZ21ZJiLoJX6/+lJC2pNZ+hnkUmX2pzDVCrmuJMPp3RD8BczZB1RvPGKz6Ty:h12oJX6WJC2vMkvMzDVCm58cZB1RvPD7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76fe5a612d0edf89ae2ef05a590c99ed_JaffaCakes118

Files

76fe5a612d0edf89ae2ef05a590c99ed_JaffaCakes118
.dll windows:6 windows x86 arch:x86

894689478f4a59d7cb9a027a32be6519

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

iscsium.pdb

Imports

msvcrt

iswdigit
_wcsicmp
localtime
time
_XcptFilter
memcpy
malloc
_initterm
_amsg_exit
_except_handler4_common
calloc
strcpy_s
_vsnwprintf
_vsnprintf
strcat_s
sprintf_s
strchr
strtoul
memset
strncpy_s
free

ntdll

RtlFreeHeap
RtlAllocateHeap

kernel32

GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
InterlockedExchange
GetCurrentProcessId
GetLastError
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
Sleep
CreateFileW
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
DisableThreadLibraryCalls
IsWow64Process
GetCurrentProcess
DeviceIoControl
SetEvent
InterlockedDecrement
QueueUserWorkItem
InterlockedIncrement
GetOverlappedResult
ResetEvent
lstrlenW
LocalFree
GetComputerNameExW
LoadLibraryW
GetSystemDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
CreateEventW
WaitForSingleObject
GetCurrentThreadId
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
SetUnhandledExceptionFilter

advapi32

RegEnumValueW
WmiQueryAllDataW
WmiOpenBlock
WmiExecuteMethodW
WmiQuerySingleInstanceW
WmiFileHandleToInstanceNameW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegQueryInfoKeyW
WmiCloseBlock
RegSetValueExW
DeregisterEventSource

ws2_32

socket
connect
closesocket
WSAStartup
WSACleanup
WSASetLastError
getservbyport
ntohs
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
htons

user32

RegisterDeviceNotificationW

crypt32

CryptUnprotectData
CryptProtectData

cfgmgr32

CM_Get_Device_ID_Size
CM_Get_Device_IDW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

Exports

Exports

DiscpAddStringToMultiSzList
DiscpAlignDataStruct
DiscpAllocMemory
DiscpAllocProcessMemory
DiscpAnsiCharsToString
DiscpAnsiToUnicode
DiscpAnsiToUnicodeSize
DiscpCopyString
DiscpCopyStringToAnsi
DiscpCopyToCountedString
DiscpCopyUnicodeString
DiscpDebugPrintX
DiscpDecryptBuffer
DiscpDisableEventlog
DiscpDisableLogToFile
DiscpDisableWinsock
DiscpDisestablishIrpPump
DiscpDuplicateString
DiscpEnableEventlog
DiscpEnableLogToFile
DiscpEnableWinsock
DiscpEncryptBuffer
DiscpEnumerateDeviceInterfaces
DiscpEnumerateRegistryValues
DiscpEstablishIrpPump
DiscpEstablishTCPSocket
DiscpExecuteMethod
DiscpFreeDeviceInterfaceList
DiscpFreeMemory
DiscpFreeProcessMemory
DiscpGenerateiScsiNameFromComputerName
DiscpGetPnpDeviceId
DiscpGetRegistryValue
DiscpGetStringFromDataBlock
DiscpGuidToString
DiscpIdKeyToString
DiscpIsDNSAddress
DiscpIsStringInList
DiscpLoadSystemLibrary
DiscpMapiSCSIString
DiscpOpenRegistryKey
DiscpPadDataBlock
DiscpParseAllData
DiscpParseKeyValue
DiscpParseSingleInstance
DiscpPnpDeviceInterfaceToInstanceName
DiscpQueryAllData
DiscpQuerySingleInstance
DiscpRegCloseKey
DiscpRegisterDebugMask
DiscpRegisterDeviceInterfaceNotification
DiscpRegisterForDeviceInterfaceNotfication
DiscpRegisterHeap
DiscpRemoveStringFromMultiSzList
DiscpReportEventlog
DiscpReportEventlogWithStatus
DiscpSendIrpRequest
DiscpSetRegistryValue
DiscpSockAddrToText
DiscpTextAddrToBinary
DiscpTimebomb
DiscpULongAddList
DiscpUTF8ToUnicode
DiscpUnicodeToAnsi
DiscpUnicodeToAnsiSize
DiscpUnicodeToUTF8
DiscpValidateiSCSIString
DiscpXtoI
Discpxtoi
DllMain

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 986B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

894689478f4a59d7cb9a027a32be6519

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ws2_32

user32

crypt32

cfgmgr32

setupapi

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 21KB

.data Size: 63KB - Virtual size: 64KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 1024B - Virtual size: 986B

.text
Size: 21KB - Virtual size: 21KB

.data
Size: 63KB - Virtual size: 64KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 1024B - Virtual size: 986B