a9da7dca66c93b9408570f7f2913e4af_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a9da7dca66c93b9408570f7f2913e4af_JaffaCakes118
Size

704KB
MD5

a9da7dca66c93b9408570f7f2913e4af
SHA1

8e4ad664c0280890da61d5a7b0e1255f01cad6f9
SHA256

d8b409137e23d1be95bc9452b69b5ee6ec76996af6bfdc25deade3830d53d5e4
SHA512

c9d554c49522e584fde02075bffed5d502efc8fd4b4d58d32abf7cb6059ec41895d6fc6079ddc20bd72b47838530a1f3abb4888aa45b19393c4f4945d7250fbc
SSDEEP

6144:RZWZvRNHf8BOYuKFJA4O5OnUfEMhetAZp3dRVClR:U/8B5nSZhtCl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9da7dca66c93b9408570f7f2913e4af_JaffaCakes118

Files

a9da7dca66c93b9408570f7f2913e4af_JaffaCakes118
.dll windows:5 windows x86 arch:x86

23ddb6240fbe66ced4fb25b7be76bcdb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

ElfReportEventW
ElfRegisterEventSourceW
RegDeleteKeyW
ElfDeregisterEventSource
RegEnumValueW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
CryptDestroyHash
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
CryptDestroyKey
CryptExportKey

kernel32

LoadLibraryW
IsDebuggerPresent
OutputDebugStringA
GetProcessHeap
SearchPathW
FormatMessageW
GetTickCount
GetSystemTimeAsFileTime
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
HeapFree
HeapCreate
HeapDestroy
HeapAlloc
GetLastError
RaiseException
GetC

ntdll

user32

Exports

Exports

CreateAssemblyCache
CreateAssemblyNameObject
SxsBeginAssemblyInstall
SxsEndAssemblyInstall
SxsFindClrClassInformation
SxsFindClrSurrogateInformation
SxsGenerateActivationContext
SxsInstallAssemblyW
SxsInstallW
SxsLookupClrGuid
SxsOleAut32MapConfiguredClsidToReferenceClsid
SxsOleAut32MapIIDOrCLSIDToTypeLibrary
SxsOleAut32MapIIDToProxyStubCLSID
SxsOleAut32MapIIDToTLBPath
SxsOleAut32MapReferenceClsidToConfiguredClsid
SxsOleAut32RedirectTypeLibrary
SxsProbeAssemblyInstallation
SxsProtectionGatherEntriesW
SxsProtectionNotifyW
SxsProtectionPerformScanNow
SxsProtectionUserLogoffEvent
SxsProtectionUserLogonEvent
SxsQueryManifestInformation
SxsRunDllInstallAssembly
SxsRunDllInstallAssemblyW
SxsUninstallW
SxspGenerateManifestPathOnAssemblyIdentity
SxspGeneratePolicyPathOnAssemblyIdentity
SxspRunDllDeleteDirectory
SxspRunDllDeleteDirectoryW

Sections

.text
Size: 612KB - Virtual size: 612KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23ddb6240fbe66ced4fb25b7be76bcdb

Headers

File Characteristics

Imports

advapi32

kernel32

ntdll

user32

Exports

Exports

Sections

.text Size: 612KB - Virtual size: 612KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 36KB - Virtual size: 36KB

.text
Size: 612KB - Virtual size: 612KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 36KB - Virtual size: 36KB