7902e98fd4d4b72809eefb1de356d1cd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7902e98fd4d4b72809eefb1de356d1cd_JaffaCakes118
Size

89KB
MD5

7902e98fd4d4b72809eefb1de356d1cd
SHA1

f32288bb81059953bba3374d6a90dc7f0a938273
SHA256

22ba1a71297103c433cb6a1d8656d1f5a81014945f3783632354e689e3f1e268
SHA512

363c910dd25608aa4ab59b812ff5dfca08e937db5ffa3b016501e253563319e7a1885e142e0f2df55dda71ee3b31807cab71bff93f0dec93b13597fdc07ff5f6
SSDEEP

1536:zjh91hpgwXtNKOxjsYhU5ej1iwuFXOwuBav4/qxgoUlafx:zjf1hpgwj5vMwOuIv4/jlafx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7902e98fd4d4b72809eefb1de356d1cd_JaffaCakes118

Files

7902e98fd4d4b72809eefb1de356d1cd_JaffaCakes118
.dll windows:5 windows x86 arch:x86

c5bdb7ee6eb35d767050e3308a943a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msgsvc.pdb

Imports

ntdll

NtQueryVirtualMemory
RtlUnwind
DbgPrint
wcsncmp
_strnicmp
wcsncpy
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
wcsstr
RtlFreeUnicodeString
NtOpenThreadToken
NtQueryInformationToken
NtClose
RtlRegisterWait
RtlInitializeCriticalSection
RtlNtStatusToDosError
NtAccessCheckAndAuditAlarm
RtlAdjustPrivilege
RtlInitUnicodeString
_itoa
wcscmp
RtlCopySid
RtlLengthSid
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlNewSecurityObject
NtOpenProcessToken
RtlDeregisterWait
strncpy
RtlUnicodeStringToOemString
RtlFreeOemString
RtlInitAnsiString
RtlInitializeResource
RtlOemStringToUnicodeString
wcslen
wcscpy

kernel32

WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LocalFree
LocalAlloc
GetLastError
LeaveCriticalSection
SetEvent
EnterCriticalSection
DeleteCriticalSection
TerminateThread
CloseHandle
GetTimeFormatW
GetDateFormatW
WaitForSingleObject
CreateThread
CreateEventW
CreateMailslotA
ReadFile
Sleep
WriteFile
InterlockedExchange
CreateFileA
GetOverlappedResult
GetLocalTime
FreeLibrary
FormatMessageA
FormatMessageW
LoadLibraryExW
GetComputerNameW
GetProcAddress
LoadLibraryW
DisableThreadLibraryCalls

advapi32

QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
SetServiceStatus
RegisterServiceCtrlHandlerExW

user32

RegisterDeviceNotificationW
UnregisterDeviceNotification
MessageBeep
MessageBoxW

netapi32

I_NetNameCanonicalize
Netbios
NetApiBufferFree
NetWkstaUserEnum
I_NetNameValidate

ws2_32

WSACleanup
WSAStartup
inet_addr
gethostbyaddr

rpcrt4

NdrServerCall2
RpcImpersonateClient
RpcRevertToSelf

iphlpapi

NotifyAddrChange

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5bdb7ee6eb35d767050e3308a943a62

Headers

File Characteristics

PDB Paths

Imports

ntdll

kernel32

advapi32

user32

netapi32

ws2_32

rpcrt4

iphlpapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 28KB

.data Size: 56KB - Virtual size: 58KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.data
Size: 56KB - Virtual size: 58KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 2KB - Virtual size: 1KB