b5963ceec412f4bd197392ec884655d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b5963ceec412f4bd197392ec884655d9_JaffaCakes118
Size

184KB
MD5

b5963ceec412f4bd197392ec884655d9
SHA1

e910b361b755aea935d707d371e461a61bb4fb5a
SHA256

958e08043f55a3277cf5f91278ac28f40edddbdf4e8271bbc20ee818b22fd160
SHA512

c27f450f17b0ad540eee73666f4b9822c5247a3738e66d52da951247e752e2ed4aa7c68639611ede9c73c6be2d2fd4b1893080719c9a254ae5e01f9a639c2489
SSDEEP

3072:vNVkMEuXBTvlOFEpHinjoRAU80z7gd3Hm3MNWm0rNgB+xzjcK8/dUvg1/gbM:HkMEUJvs+p+QJ7gxm3yQHcNdU49gbM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5963ceec412f4bd197392ec884655d9_JaffaCakes118

Files

b5963ceec412f4bd197392ec884655d9_JaffaCakes118
.dll windows:6 windows x86 arch:x86

b10f87072ed9e79f086be44a0be20724

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsldp.pdb

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wtoi64
wcstok
swscanf_s
_wtol
_ltow
_itow_s
_wcslwr
wcsstr
_wcsnicmp
qsort
wcschr
memcpy
wcscpy_s
memset
_wcsicmp
swprintf_s
wcscat_s
wcsncpy_s
_purecall

api-ms-win-core-localregistry-l1-1-0

RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner

kernel32

GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
TerminateProcess
FormatMessageW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
DisableThreadLibraryCalls
GetProcAddress
GetLastError
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetSystemDirectoryW
SetLastError
InterlockedIncrement
InterlockedDecrement
GetTickCount
CompareStringW
LocalFree
LocalAlloc
RaiseException
lstrlenW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
InterlockedExchange
Sleep
QueryPerformanceCounter
GetCurrentThreadId

activeds

ord14
ord15
ord18
ord17
ord12
ord16
ord28
ord27
ord7
ord3
ord31
ord25
ord22
ord26

adsldpc

ADsCreateAttributeDefinition
ADsWriteAttributeDefinition
ADsDeleteAttributeDefinition
ADsEnumClasses
ADsCreateClassDefinition
ADsEnumAttributes
ADsDeleteClassDefinition
LdapcKeepHandleAround
LdapGetSyntaxIdOfAttribute
LdapCacheAddRef
ADsHelperGetCurrentRowMessage
ADsFreeColumn
ADsGetNextColumnName
ADsGetColumn
ADsWriteClassDefinition
ADsGetPreviousRow
FreeObjectInfo
ADsObject
LdapTypeFreeLdapObjects
LdapGetSchemaObjectCount
LdapGetSubSchemaSubEntryPath
LdapMakeSchemaCacheObsolete
BuildLDAPPathFromADsPath2
SchemaGetSyntaxOfAttribute
LdapGetSyntaxOfAttributeOnServer
SchemaGetStringsFromStringTable
LdapValueFree
LdapMsgFree
LdapCloseObject
LdapGetValues
LdapFirstEntry
LdapCountEntries
LdapSearchS
LdapOpenObject
SortAndRemoveDuplicateOIDs
FindSearchTableIndex
intcmp
FindEntryInSearchTable
SchemaClose
LdapAddS
LdapReadAttribute
ADsGetNextRow
SchemaGetClassInfo
SchemaOpen
SchemaGetPropertyInfo
SchemaAddRef
SchemaGetClassInfoByIndex
SchemaGetPropertyInfoByIndex
SchemaGetObjectCount
?GetNextToken@CLexer@@QAEJPAGPAK@Z
PathName
??1CLexer@@QAE@XZ
Component
?SetAtDisabler@CLexer@@QAEXH@Z
InitObjectInfo
?InitializePath@CLexer@@QAEJPAG@Z
??0CLexer@@QAE@XZ
GetDisplayName
IsGCNamespace
BuildADsParentPath
BuildADsPathFromLDAPPath2
LdapReadAttributeFast
LdapOpenObject2
GetDefaultServer
LdapGetNextPageS
LdapSearchExtS
LdapSearchInitPage
ReadPagingSupportedAttr
LdapMemFree
?SetFSlashDisabler@CLexer@@QAEXH@Z
LdapGetDn
LdapNextEntry
LdapSearchAbandonPage
BuildADsPathFromParent
BuildADsParentPathFromObjectInfo2
ADSIPrint
AdsTypeToLdapTypeCopyTime
AdsTypeToLdapTypeCopyGeneralizedTime
AdsTypeToLdapTypeCopyDNWithBinary
AdsTypeToLdapTypeCopyDNWithString
LdapTypeToAdsTypeUTCTime
LdapTypeToAdsTypeGeneralizedTime
LdapTypeToAdsTypeDNWithBinary
LdapTypeToAdsTypeDNWithString
LdapTypeFreeLdapModList
LdapTypeCopyConstruct
LdapValueFreeLen
UnMarshallLDAPToLDAPSynID
LdapNextAttribute
LdapAttributeFree
LdapFirstAttribute
LdapTypeFreeLdapModObject
LdapModifyExtS
ReadSecurityDescriptorControlType
ReadServerSupportsIsADAMControl
ReadServerSupportsIsADControl
LdapAddExtS
LdapDeleteS
GetServerAndPort
AdsTypeFreeAdsObjects
AdsTypeToLdapTypeCopyConstruct
LdapTypeToAdsTypeCopyConstruct
LdapDeleteExtS
LdapcSetStickyServer
BerEncodingQuotaControl
LdapRenameExtS
LdapModDnS
GetLDAPTypeName
LdapInitializeSearchPreferences
LdapTypeBinaryToString
MapLDAPTypeToADSType
MapADSTypeToLDAPType
ADsSetObjectAttributes
ADsGetObjectAttributes
ADsDeleteDSObject
ADsCreateDSObjectExt
ADsSetSearchPreference
ADsExecuteSearch
ADsAbandonSearch
ADsCloseSearchHandle
ADsGetFirstRow
LdapModifyS

wldap32

ord53
ord54
ord12

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b10f87072ed9e79f086be44a0be20724

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-localregistry-l1-1-0

api-ms-win-security-base-l1-1-0

kernel32

activeds

adsldpc

wldap32

Exports

Exports

Sections

.text Size: 158KB - Virtual size: 157KB

.data Size: 16KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 158KB - Virtual size: 157KB

.data
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB