cf1c9244c71b1cf496a7a93bfc7191ef_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

cf1c9244c71b1cf496a7a93bfc7191ef_JaffaCakes118
Size

113KB
MD5

cf1c9244c71b1cf496a7a93bfc7191ef
SHA1

dfdf2e1bf9c516c7f6bde2a5aff0b65cf79991c4
SHA256

5f934ce4c5fcff3921139e60434dbfcc285086547bdba2f82db412f785b97186
SHA512

dd8a6a0342039ba2453e144713047e1d51b09b27a064b93acf14b685e7224f7bb95469f938a9356cbea14d90f75eaddcf75edb4247c19a146935181d57d0a6df
SSDEEP

3072:VUs2Og8EUsxrMNkD8dnkgi6J/GQPTwJ1qUVzFFT:cOg8mMKDgPJ+QLQP7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf1c9244c71b1cf496a7a93bfc7191ef_JaffaCakes118

Files

cf1c9244c71b1cf496a7a93bfc7191ef_JaffaCakes118
.dll windows:4 windows x86 arch:x86

02631d33d1dfb217667aa0066762a5b8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\NPS_VSS_ROOT\NPS\bin\release\program files\modelextension\SCH_W810.pdb

Imports

mfc80u

ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord3677
ord2925
ord1911
ord3826
ord5378
ord6215
ord566
ord5096
ord757
ord1007
ord3943
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord3824
ord4008
ord4032
ord6751
ord765
ord315
ord1079
ord1033
ord1087
ord1197
ord1199
ord1093
ord371
ord1908
ord1162
ord1115
ord1192
ord1168
ord1170
ord314
ord1200
ord581
ord4475
ord4255
ord3327
ord5558
ord283
ord1182
ord860
ord1248
ord2311
ord577
ord293
ord3800
ord764

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
_time64
_vsnwprintf_s
_localtime64_s
??2@YAPAXI@Z
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__CxxFrameHandler3

kernel32

LoadLibraryA
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
LocalFree
OutputDebugStringW
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
IsDebuggerPresent

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime

Exports

Exports

GetBinaryLoader
GetDLLVersion
GetModelType
IsNPSSupport
IsValidModelLib
RebootDownMode

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02631d33d1dfb217667aa0066762a5b8

Headers

File Characteristics

PDB Paths

Imports

mfc80u

msvcr80

kernel32

oleaut32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 1KB - Virtual size: 1KB