8acb83a9061bd9ec01abee89d1e8f02c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8acb83a9061bd9ec01abee89d1e8f02c_JaffaCakes118
Size

164KB
MD5

8acb83a9061bd9ec01abee89d1e8f02c
SHA1

4fa1306bb2ec0285d078f6859370af412e8c6baf
SHA256

49d136aaeb38a8753dfe547d68fc16df8438a4a0ee4043ec3546a54ab8411056
SHA512

10615eec1fb07bb8b64e9525e4b154bcd48e7d35f3796a062ba8371e06a027f5e0c65c705ebc6e6a75f22ef7f02cef5215ab11b30d238b5474c27c0d7ee3209e
SSDEEP

3072:Zs0huqUfzlx8qXBX4y3VXWQ2t+4OaVh4yMQHWl:ZsNRlyqN4+2I4NX4fSe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8acb83a9061bd9ec01abee89d1e8f02c_JaffaCakes118

Files

8acb83a9061bd9ec01abee89d1e8f02c_JaffaCakes118
.dll windows:6 windows x86 arch:x86

533843fbac3fea5fe69fc5b77d2c5aa6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActionQueue.pdb

Imports

msvcrt

memset
memcpy
qsort
_vsnwprintf
iswspace
wcstoul
_purecall
wcsrchr
_wcsnicmp
wcschr
_vsnprintf
_onexit
_lock
__dllonexit
_unlock
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter

ntdll

DbgUserBreakPoint
NtYieldExecution
RtlUnwind
RtlNtStatusToDosError
RtlRaiseStatus
RtlInitializeCriticalSection
RtlAllocateHeap
RtlFreeHeap
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlReAllocateHeap
RtlDeleteCriticalSection

kernel32

GetProcessHeap
CreateDirectoryW
SetLastError
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedIncrement
InterlockedDecrement
GetLastError
WriteFile
lstrlenA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
DisableThreadLibraryCalls
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
ReadFile
GetFileSize
CreateFileW
lstrcmpiW
GetWindowsDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
HeapAlloc
HeapFree
CompareStringW
InterlockedExchange

ole32

CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumValueW

user32

CharNextW

Exports

Exports

GenerateActionQueue
ProcessActionQueue

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

533843fbac3fea5fe69fc5b77d2c5aa6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

ole32

advapi32

user32

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 151KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 152KB - Virtual size: 151KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB