c800f6971b43dd5f94c16192757d6d8a_JaffaCakes118

General

Target

c800f6971b43dd5f94c16192757d6d8a_JaffaCakes118
Size

12KB
MD5

c800f6971b43dd5f94c16192757d6d8a
SHA1

fd15842121dd8882a8e8a3fc1c59999df7f179ea
SHA256

06ec70ef121dc0a4ec0e1f6c40da04f45a20caee07c03fe6ec599f317046f4a5
SHA512

6b9ff937500e8618c357fba405f58e657e21ccebe389fc980587ec9111682d4d8896b7e465df832758f2aee2531e23cae32a6872f3425a9a46d06be0fa1406d5
SSDEEP

192:QgLjwsSf6aDeu2zqEphZRIitRx0x5Hqy+E0sAZov:bfwsSfau2zqEpDBRx0x5ApsAC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c800f6971b43dd5f94c16192757d6d8a_JaffaCakes118

Files

c800f6971b43dd5f94c16192757d6d8a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e57f9108b8b51e91f36b8fdaa09392e0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CloseHandle
DeviceIoControl
GlobalFree
LoadLibraryExA
GlobalAlloc
FreeLibrary
WriteFile
WriteProcessMemory
VirtualProtectEx
OpenProcess
GetCurrentProcessId
LoadLibraryA
GetProcAddress
CreateThread
Sleep
GetSystemDirectoryA
lstrcatA
ExitProcess
CreateFileA
GetModuleHandleA

advapi32

StartServiceA
QueryServiceStatus
DeleteService
CloseServiceHandle
OpenSCManagerA
CreateServiceA
OpenServiceA
ControlService

msvcrt

__CxxFrameHandler
??3@YAXPAX@Z
free
_initterm
malloc
_adjust_fdiv

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e57f9108b8b51e91f36b8fdaa09392e0

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

Exports

Exports

Sections

.data Size: 10KB - Virtual size: 10KB

.reloc Size: 512B - Virtual size: 488B

.data
Size: 10KB - Virtual size: 10KB

.reloc
Size: 512B - Virtual size: 488B