855ccde623f8d4de759af86fbf7c38f3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

855ccde623f8d4de759af86fbf7c38f3_JaffaCakes118
Size

128KB
MD5

855ccde623f8d4de759af86fbf7c38f3
SHA1

335b9304308c27ee69b1091db093adb867093f6b
SHA256

73b634c87285043670dd4f91f3b3b7915ec14096d5068405f7e00a8c7b203220
SHA512

0179f4e85ec161826385f479b151eb37765c110cc9337aac2c57aff6f390c56022f5d6acad9ee2cec854bd457789c70d137a34e3a7e0f804f845f2742a117323
SSDEEP

1536:lFCXlz1MuvFU7eH6N7gAYuv5X/POFpLWXraE+FIE5miSQdZnMo5kjaea:lUXla0Ft6SAYA5PPOrS7ajyE5miRkC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
855ccde623f8d4de759af86fbf7c38f3_JaffaCakes118

Files

855ccde623f8d4de759af86fbf7c38f3_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

6d0c256483900cce11bfba9fd240f679

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dispex.pdb

Imports

msvcrt

_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
??3@YAXPAX@Z
??2@YAPAXI@Z

rpcrt4

NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrClientCall2
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease

kernel32

RtlUnwind
LoadLibraryA
GetProcAddress
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange

oleaut32

VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 4KB - Virtual size: 329B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d0c256483900cce11bfba9fd240f679

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

kernel32

oleaut32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 9KB

.orpc Size: 4KB - Virtual size: 329B

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 100KB - Virtual size: 98KB

.reloc Size: 4KB - Virtual size: 756B

.text
Size: 12KB - Virtual size: 9KB

.orpc
Size: 4KB - Virtual size: 329B

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 100KB - Virtual size: 98KB

.reloc
Size: 4KB - Virtual size: 756B