d15ffbfca1a77d38eeaeb97c951776ce_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d15ffbfca1a77d38eeaeb97c951776ce_JaffaCakes118
Size

232KB
MD5

d15ffbfca1a77d38eeaeb97c951776ce
SHA1

169a281c6b9a29395bb2369cef68855b71309846
SHA256

1b087834697fd3a57747bce5abe97b16e5a472daa4ae8ac2c1585362810502f6
SHA512

fcc7b5bfbd746b35160474fc823f40178a2d301a6fcf8827a6ac7d91370d7fdd3d3503d6093807a2539298126b7964047268cb6facaf53b8cacc46e3b462f5be
SSDEEP

6144:Pz4FMKTen54VDh5qMzy6QDKRyBwGNids1GgRA:kFMsdpT1GoG7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d15ffbfca1a77d38eeaeb97c951776ce_JaffaCakes118

Files

d15ffbfca1a77d38eeaeb97c951776ce_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e9ff72667ec7b92540e8afc6abb28d02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
GetCPInfo
GetLocaleInfoA
GetSystemInfo
GetCurrentProcessId
HeapReAlloc
VirtualAlloc
HeapAlloc
VirtualFree
GetStringTypeW
GetStringTypeA
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
VirtualProtect
DisableThreadLibraryCalls
LCMapStringW
WideCharToMultiByte
LCMapStringA
SetUnhandledExceptionFilter
HeapFree
VirtualQuery
LocalFree
LocalAlloc
IsDBCSLeadByte
GetLastError
MultiByteToWideChar
SetLastError
CloseHandle
LocalReAlloc
Sleep
InterlockedExchange

ntdll

RtlUnwind
RtlUpcaseUnicodeString
RtlFreeUnicodeString
RtlAllocateAndInitializeSid
RtlIsDosDeviceName_U
RtlNtStatusToDosError
NtQueryDefaultLocale
NtCreateFile
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
RtlUnicodeStringToOemString
NtOpenFile
NtFsControlFile
NtClose
RtlInitUnicodeString

advapi32

GetSecurityDescriptorDacl
AddAccessAllowedAce
MakeAbsoluteSD
SetSecurityDescriptorDacl
RegSetKeySecurity
RegGetKeySecurity

nwprovau

NPOpenEnum
NPCancelConnection
NPCloseEnum
NPAddConnection
NPEnumResource

Exports

Exports

FormatBuf
FragExWithWait
MapSpecialJapaneseChars
NWAddTrusteeToDirectory
NWAllocPermanentDirectoryHandle
NWAllocTemporaryDirectoryHandle
NWAttachToFileServer
NWAttachToFileServerW
NWCAddObjectToSet
NWCAddTrustee
NWCAddTrusteeToDirectory
NWCAllocPermanentDirectoryHandle
NWCAllocTemporaryDirectoryHandle
NWCAttachToFileServer
NWCAttachToFileServerW
NWCChangePropertySecurity
NWCCheckConsolePrivileges
NWCCreateDirectory
NWCCreateObject
NWCCreateProperty
NWCCreateQueue
NWCDeallocateDirectoryHandle
NWCDeleteObject
NWCDeleteObjectFromSet
NWCDeleteProperty
NWCDestroyQueue
NWCDetachFromFileServer
NWCGetBinderyAccessLevel
NWCGetFileServerDateAndTime
NWCGetFileServerVersionInfo
NWCGetInternetAddress
NWCGetObjectID
NWCGetObjectName
NWCGetVolumeInfoWithHandle
NWCGetVolumeInfoWithNumber
NWCGetVolumeName
NWCGetVolumeNumber
NWCIsObjectInSet
NWCLoginToFileServer
NWCLogoutFromFileServer
NWCReadPropertyValue
NWCRenameBinderyObject
NWCScanDirectoryForTrustees2
NWCScanForTrustees
NWCScanObject
NWCScanProperty
NWCWritePropertyValue
NWCheckConsolePrivileges
NWDeallocateDirectoryHandle
NWDetachFromFileServer
NWGetFileServerDateAndTime
NWGetFileServerVersionInfo
NWGetInternetAddress
NWGetObjectName
NWGetVolumeInfoWithHandle
NWGetVolumeInfoWithNumber
NWGetVolumeName
NWIsObjectInSet
NWLoginToFileServer
NWLogoutFromFileServer
NWPAddObjectToSet
NWPAddTrustee
NWPAttachToFileServerW
NWPChangeObjectPasswordEncrypted
NWPCreateDirectory
NWPCreateObject
NWPCreateProperty
NWPDeleteObject
NWPDeleteObjectFromSet
NWPDeleteProperty
NWPDetachFromFileServer
NWPGetChallengeKey
NWPGetFileServerVersionInfo
NWPGetObjectID
NWPGetObjectName
NWPLoginToFileServerW
NWPLogoutFromFileServer
NWPReadPropertyValue
NWPRenameBinderyObject
NWPScanObject
NWPScanProperty
NWPWritePropertyValue
NWReadPropertyValue
NWScanObject
NWScanProperty
NwDupStringA
NwLibCanonLocalName
NwLibCanonRemoteName
NwLibCanonUserName
NwLibSetEverybodyPermission
NwLibValidateLocalName
NwNdsAddAttributeToClass
NwNdsAddObject
NwNdsChangePassword
NwNdsChangeUserPassword
NwNdsCloseObject
NwNdsConnHandleFree
NwNdsCreateBuffer
NwNdsCreateQueryNode
NwNdsDefineAttribute
NwNdsDefineClass
NwNdsDeleteAttrDef
NwNdsDeleteClassDef
NwNdsDeleteQueryNode
NwNdsDeleteQueryTree
NwNdsFreeBuffer
NwNdsGetAttrDefListFromBuffer
NwNdsGetAttrListFromBuffer
NwNdsGetClassDefListFromBuffer
NwNdsGetEffectiveRights
NwNdsGetObjectListFromBuffer
NwNdsGetQueueInformation
NwNdsGetSyntaxID
NwNdsGetTreeContext
NwNdsGetVolumeInformation
NwNdsIsNdsConnection
NwNdsList
NwNdsListSubObjects
NwNdsModifyObject
NwNdsMoveObject
NwNdsObjectHandleToConnHandle
NwNdsOpenGenericHandle
NwNdsOpenObject
NwNdsOpenStream
NwNdsOpenTreeHandle
NwNdsPutInBuffer
NwNdsReadAttrDef
NwNdsReadAttribute
NwNdsReadClassDef
NwNdsReadObject
NwNdsReadObjectInfo
NwNdsRemoveObject
NwNdsRenameObject
NwNdsResolveName
NwNdsSearch
NwNdsSetTreeContext
NwOpenHandleWithSupplementalCredentials
NwlibCopyStringToBuffer
NwlibMakeNcp
ParseResponse
UnmapSpecialJapaneseChars

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e9ff72667ec7b92540e8afc6abb28d02

Headers

File Characteristics

Imports

kernel32

ntdll

advapi32

nwprovau

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 54KB

.data Size: 172KB - Virtual size: 172KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 55KB - Virtual size: 54KB

.data
Size: 172KB - Virtual size: 172KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 2KB - Virtual size: 2KB