a8b18b983f13d925f541bb8d76edc505_JaffaCakes118

General

Target

a8b18b983f13d925f541bb8d76edc505_JaffaCakes118
Size

9KB
MD5

a8b18b983f13d925f541bb8d76edc505
SHA1

55da4deae50014e26129efec32cefb7aacc2b21e
SHA256

89e27c9b5db1c47920882eda233630334082eda9b9696ce691d618c141086c99
SHA512

0f0be08a3544d0dcb5f2be1156354ab9c84c7124763d69f979f452b945828108de392554d87201c0bc719cf54861b4f44802fcf1bef895e3fada61b5b41dfcc7
SSDEEP

192:BJoIamBZJTiMgAErX3aOtGT6z2JaWOT/WWjsG:bvlilAs6OtG6WOT/WW7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8b18b983f13d925f541bb8d76edc505_JaffaCakes118

Files

a8b18b983f13d925f541bb8d76edc505_JaffaCakes118
.dll windows:6 windows x86 arch:x86

705fb4b7b95340a6ee8e7ae9aa55d341

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

acproxy.pdb

Imports

msvcrt

_except_handler4_common
_XcptFilter
_amsg_exit
_initterm
free
malloc

ntdll

WinSqmIsOptedInEx
RtlFreeHeap
RtlAllocateHeap

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentProcess
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
GetTickCount
Sleep
GetLastError
CloseHandle
ReadFile
CreateFileW
FindVolumeClose
DeleteFileW
GetDriveTypeW
FindNextVolumeW
FindFirstVolumeW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource

ulib

??0DSTRING@@QAE@XZ
?UploadSqmFromFile@SQMEXPORT@@SGEPAX@Z
??1DSTRING@@UAE@XZ
??1HMEM@@UAE@XZ
??1OBJECT@@UAE@XZ
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Resize@HMEM@@QAEEKK@Z
?Initialize@FSTRING@@QAEPAVWSTRING@@PAGK@Z
?Acquire@HMEM@@UAEPAXKK@Z
?Initialize@HMEM@@QAEEXZ
??0FSTRING@@QAE@XZ
??0HMEM@@QAE@XZ

Exports

Exports

PerformAutochkOperations

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

705fb4b7b95340a6ee8e7ae9aa55d341

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ulib

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 844B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 470B

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 844B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 470B