ba377a3d1968e9574d2b475ea37560b7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ba377a3d1968e9574d2b475ea37560b7_JaffaCakes118
Size

52KB
MD5

ba377a3d1968e9574d2b475ea37560b7
SHA1

c2a1728e8917649a9c118a64b6daeed0c17bd4fd
SHA256

92f182d4d98e779af05b0df8a1b7f71b4826cf49b03d9a32fe7ce0b7139d7391
SHA512

7a9ec48d76de71f942f01e6b3a8aa2dcc7768efe0167d308c84039319850c8741139f36629d27440d166c015e03e63a949994986eac0c6f82bab04757f3d9ce1
SSDEEP

1536:sV8pOu/NRlxm64FmX4qSqJR4S8YFbd+QDFo:sV8cu1fxfpXttJR3PFbd+QDFo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba377a3d1968e9574d2b475ea37560b7_JaffaCakes118

Files

ba377a3d1968e9574d2b475ea37560b7_JaffaCakes118
.dll windows:5 windows x86 arch:x86

548a49f4226587015c87bb58f5f39837

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ExitThread
GetStdHandle
InterlockedDecrement
GetCommandLineA
GetVersion
HeapCompact
VirtualAlloc
LoadLibraryA
InitializeCriticalSection
LocalAlloc
GetFileType
SetThreadPriority
Sleep
WaitForSingleObject
FreeLibrary
GetPrivateProfileStringA
GetCurrentThreadId
GetLocalTime
SuspendThread

ntdll

ZwCreateEvent
ZwClose

Exports

Exports

GetInterfaceInfo
CreateProcessNotify
GetIpErrorString
InternalSetIpNetEntry
DeleteIPAddress
InternalGetIpAddrTable
DllClientCleanup
GetBestInterface
nvcpinst
IcmpSendEcho2
NotifyRouteChange
DllClientStartup
Icmp6ParseReplies
IcmpSendEcho
GetBestInterfaceEx
register_icmp
GetAdaptersAddresses
SetIpStatistics
GetIfEntry
GetIcmpStatistics
DisableMediaSense
GetTcpStatisticsEx
UnenableRouter
Icmp6CreateFile
GetUdpStatistics
SetAdapterIpAddress
GetAdaptersInfo
InternalGetUdpTable
DeleteProxyArpEntry
NTTimeToNTPTime
GetUdpTable
GetUniDirectionalAdapterInfo
do_echo_req
FlushIpNetTable
CreateIpForwardEntry
GetUdpStatisticsEx
NhGetInterfaceNameFromGuid
GetOwnerModuleFromUdp6Entry
GetIpNetTable
GetIpForwardTable
InternalCreateIpNetEntry
GetExtendedUdpTable
DeleteIpNetEntry
DeleteIpForwardEntry
GetIpStatisticsEx
GetOwnerModuleFromTcpEntry
GetAdapterOrderMap
NhGetGuidFromInterfaceName
GetIpAddrTable
IpReleaseAddress
InternalGetIpNetTable
InternalGetIfTable
GetAdapterIndex
EnableRouter
Icmp6SendEcho2
NhpAllocateAndGetInterfaceInfoFromStack
GetOwnerModuleFromTcp6Entry
GetPerAdapterInfo
InternalGetTcpTable
SetTcpEntry
GetIpStatistics
InternalDeleteIpForwardEntry
GetNetworkParams
GetTcpTable
InternalSetIfEntry
GetBestRoute
InternalSetTcpEntry
CancelIPChangeNotify
do_echo_rep
RestoreMediaSense
CreateIpNetEntry
GetRTTAndHopCount

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

548a49f4226587015c87bb58f5f39837

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.data Size: 10KB - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 40KB

.data
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB