a36ab17af3a54a76322d99281c25056e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a36ab17af3a54a76322d99281c25056e_JaffaCakes118
Size

1.1MB
MD5

a36ab17af3a54a76322d99281c25056e
SHA1

4218e79f67dd4ffa485c95596ea061770fa54a6b
SHA256

1fa2833196a59a288872f71846864065cd15d934b5850af7b6b10e8d8e2129b5
SHA512

0780b77b51d3a9aa689157386db6cf5870aa9be545dc23bda419251b0d1a63eda0a64f13abe8e4647aef80aff79b16b0dfa50753467d5fc0c5e0c742a55e36e1
SSDEEP

24576:nqrCuAzHqZZezMjvArEPgsdYyxzK/RQluhqxIWDWE8iXZQM:qczQ+eud35IVIWD1XZQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a36ab17af3a54a76322d99281c25056e_JaffaCakes118

Files

a36ab17af3a54a76322d99281c25056e_JaffaCakes118
.exe windows:2 windows x86 arch:x86

bc45cac95ebfd754b0271f86b625ffd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

EndPaint
DispatchMessageA
BeginPaint
DestroyWindow
UpdateWindow
CreateWindowExA
DefWindowProcA
GetMessageA
TranslateMessage
ShowWindow
RegisterClassA
SendMessageA

adsldpc

SchemaAddRef
LdapGetValues
LdapReadAttributeFast
MapADSTypeToLDAPType
ADsDecodeBinaryData
ADsAbandonSearch
BuildADsPathFromParent
LdapcKeepHandleAround
ADsGetFirstRow
ADSICloseSearchHandle
ReadSecurityDescriptorControlType
ReadServerSupportsIsADControl
ADsWriteAttributeDefinition
LdapSearch
LdapSearchExtS
InitObjectInfo
LdapNextEntry
AdsTypeToLdapTypeCopyConstruct
ADsExecuteSearch
GetDomainDNSNameForDomain
GetDisplayName
ADsCreateDSObject
LdapMemFree
ADsGetPreviousRow
LdapNextAttribute
ADsDeleteDSObject
AdsTypeToLdapTypeCopyTime
LdapDeleteExtS
ADsGetNextRow
FindEntryInSearchTable
ADSIDeleteDSObject
ADsEnumAttributes
ADSICloseDSObject
ADSIExecuteSearch
LdapTypeBinaryToString
GetDefaultServer
LdapControlFree
LdapValueFree
ADsSetSearchPreference
ReadPagingSupportedAttr
ADsWriteClassDefinition

kernel32

ConnectNamedPipe
WaitForMultipleObjects
CreateEventA
GetProcessHeap
SetEvent
GetSystemTimeAsFileTime
CreateFileA
GetSystemTimeAdjustment
ReadFileScatter
WriteFileEx
HeapDestroy
CreateNamedPipeA
GetSystemTime
HeapFree
DisconnectNamedPipe
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
InterlockedPushEntrySList
HeapAlloc
OpenEventA
SetFirmwareEnvironmentVariableA
GetSystemTimes
WaitNamedPipeA
CloseHandle
InitializeCriticalSection
VirtualAlloc
GetLastError
VirtualFree
InterlockedPopEntrySList
ReadFile
HeapCreate
InterlockedFlushSList
ExitProcess

Sections

.text
Size: 924KB - Virtual size: 924KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc45cac95ebfd754b0271f86b625ffd5

Headers

DLL Characteristics

File Characteristics

Imports

user32

adsldpc

kernel32

Sections

.text Size: 924KB - Virtual size: 924KB

.data Size: 114KB - Virtual size: 113KB

.rsrc Size: 69KB - Virtual size: 3.2MB

.text
Size: 924KB - Virtual size: 924KB

.data
Size: 114KB - Virtual size: 113KB

.rsrc
Size: 69KB - Virtual size: 3.2MB