88d77a9517e5ea395535bfa87d7721e1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

88d77a9517e5ea395535bfa87d7721e1_JaffaCakes118
Size

11KB
MD5

88d77a9517e5ea395535bfa87d7721e1
SHA1

4cca291db698fa6d7b739f3b529668e0e8d50756
SHA256

3667d74e683753399eb326be2695a6adf4c5a0728d893bcf884c3f75c5e2ced7
SHA512

b8348722c39752dcb2c762bb5510d0706e998964e97635fdac145daafb2986834c2b4dab7cbed8a500226e2ee8a1a19796c081f29d951c2919592f570771ac1f
SSDEEP

192:LowB21wkkmci+eh+VZgkOVhPlYDZntUEhjeaTYDnzD6fMj8:LBw1kw+YWgkOVhPC5hjJUWT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88d77a9517e5ea395535bfa87d7721e1_JaffaCakes118

Files

88d77a9517e5ea395535bfa87d7721e1_JaffaCakes118
.dll windows:6 windows x86 arch:x86

12622fc9a4aba4c2bfb0878a6cb1bd1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\Co 5990\COHook\Release\COHook.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
GetLastError
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibraryAndExitThread
DisableThreadLibraryCalls
VirtualProtect
GetCurrentProcess
TerminateProcess
CloseHandle
WriteProcessMemory
GetCurrentProcessId
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
OutputDebugStringW
IsDebuggerPresent

psapi

GetModuleInformation

vcruntime140

__CxxFrameHandler3
memset
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_initialize_onexit_table

Exports

Exports

?Initialize@@YAHXZ

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12622fc9a4aba4c2bfb0878a6cb1bd1d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

psapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 36B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 488B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 36B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 488B