8226037e3126826420299fa78bd1e835_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8226037e3126826420299fa78bd1e835_JaffaCakes118
Size

200KB
MD5

8226037e3126826420299fa78bd1e835
SHA1

67690cc05712a6b1e840aa7b05f3b598a6161dda
SHA256

97cb552c00413ccd8f05e19a686cfb64de7fa61d34528b18f6b1549b56fa3217
SHA512

67f938de89aa17a4362d31cdb2e551c00312557ce2495553fa5608bcb0fe187652ab13d808eb945320dcddd4ba2301eede8ebe0b6a179d1ec5c360fc8ef74c0b
SSDEEP

3072:IqXyVQRJNgkNau1cHogql099Zol+s2HavOLhoUCDmr41ZxtSHFzGZ8j1MQj2:IqXeQrN6Qcbq69auWUC3xUl8S1N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8226037e3126826420299fa78bd1e835_JaffaCakes118

Files

8226037e3126826420299fa78bd1e835_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b38ae6d04877dd52d25111e83ea28bdc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
DeviceIoControl
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
OutputDebugStringA
LoadLibraryA
WaitForSingleObject
GetVersionExA
CreateFileA
OpenMutexA
CreateMutexA
GetSystemDirectoryA
GetProcAddress
WaitForMultipleObjects
GetModuleFileNameA

advapi32

RegQueryValueExA
RegOpenKeyExA

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces

wsock32

ntohl
ntohs

msvcrt

_adjust_fdiv
_initterm
fopen
strrchr
fclose
malloc
free
fflush
fprintf
strerror
_errno
sprintf

Exports

Exports

SetLogfileHandle
TDDL_Cancel
TDDL_Close
TDDL_GetCapability
TDDL_GetResultStr
TDDL_GetStatus
TDDL_GetStatusStr
TDDL_Open
TDDL_SetCapability
TDDL_TransmitData
TDDL_TransmitData_TimeOut
TPM_ClearSCL
TPM_CreateEKPair
TPM_CreateWrapKey
TPM_EvictKey
TPM_FlashOperation
TPM_GetCapability_Key_Handle
TPM_GetCapability_Pcrs
TPM_GetCapability_Slots
TPM_GetCapability_Version
TPM_GetCapability_Version12
TPM_GetUpgradeFirmwareInfo
TPM_LoadKey
TPM_OIAP
TPM_OSAP
TPM_PcrRead
TPM_ReadPubek
TPM_Reset
TPM_SaveState
TPM_Seal
TPM_Seal_CurrPCR
TPM_SelfTestFull
TPM_SetAppCallback
TPM_Sign
TPM_StartUp
TPM_TakeOwnership
TPM_Terminate_Handle
TPM_Transmit
TPM_Unseal
TPM_UpgradeFWFacade
TPM_UpgradeFirmware
authhmac
checkhmac1
convpubkey
rawhmac
sha1

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b38ae6d04877dd52d25111e83ea28bdc

Headers

File Characteristics

Imports

kernel32

advapi32

setupapi

wsock32

msvcrt

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 3KB

.shared Size: 4KB - Virtual size: 4B

.rsrc Size: 168KB - Virtual size: 164KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 3KB

.shared
Size: 4KB - Virtual size: 4B

.rsrc
Size: 168KB - Virtual size: 164KB

.reloc
Size: 4KB - Virtual size: 1KB