b743bf07a3a058fc26e7d8d7d0e2c412_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b743bf07a3a058fc26e7d8d7d0e2c412_JaffaCakes118
Size

81KB
MD5

b743bf07a3a058fc26e7d8d7d0e2c412
SHA1

166bba9d463ec7973f5e337b1ccc6b51e697c599
SHA256

f60dee922a9d006cf9e38447c78877ff0a9b3973572dffd4094163f6aafa927d
SHA512

4dc13d2eabf47dcd5df07811aa8459f8f48006dd0142768e4829d1c2821c8e6d600061e376d00f63aabe209605a5e54d3066b7518146da04912fec7cd6ee6fc3
SSDEEP

1536:8v4alVOSXd/knW56/lg6Gxi2EKI924lKGpSDZILw:8v4soMdMt8xiJsGcFIk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b743bf07a3a058fc26e7d8d7d0e2c412_JaffaCakes118

Files

b743bf07a3a058fc26e7d8d7d0e2c412_JaffaCakes118
.dll regsvr32 windows:6 windows x86 arch:x86

94efda5bc0f8ce7c190f199378fa6d4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

lsmproxy.pdb

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
DisableThreadLibraryCalls
InterlockedExchange

rpcrt4

CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_IsIIDSupported
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 477B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94efda5bc0f8ce7c190f199378fa6d4b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

rpcrt4

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.orpc Size: 512B - Virtual size: 477B

.data Size: 61KB - Virtual size: 62KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 14KB

.orpc
Size: 512B - Virtual size: 477B

.data
Size: 61KB - Virtual size: 62KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 2KB - Virtual size: 1KB