daddf72fb048018e45d3e1bdff5ae77d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

daddf72fb048018e45d3e1bdff5ae77d_JaffaCakes118
Size

44KB
MD5

daddf72fb048018e45d3e1bdff5ae77d
SHA1

bbb132015f67cf334a9f3ad1b13099b9f2fa24f7
SHA256

653fd89aaaa90b0380adb4b78a4c21e129d385338f416bda5b6d338d9ef635fc
SHA512

820a4f2a47e45e740f1aa8fed1aca7b63c9dcaa4d3a5d4559b2d3eee78e4589a235ae19c6877aaea7e06c6149a0e0f97cd1b4a87149aeec3df0b4918ef90aadf
SSDEEP

768:BWhbcUXpKgS1J+5Mtj56IlAaR3nsN7DA65nziDObyUobvTFGDaNHbO77DIDf:Bcbvem5MtkIlReAynG1U929Kw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
daddf72fb048018e45d3e1bdff5ae77d_JaffaCakes118

Files

daddf72fb048018e45d3e1bdff5ae77d_JaffaCakes118
.dll windows:6 windows x86 arch:x86

894e5d4aaa6a098c923a818ff40d2719

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetProcAddress

ntdll

memset

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken

api-ms-win-security-base-l1-1-0

PrivilegeCheck

Exports

Exports

BCryptAddContextFunction
BCryptAddContextFunctionProvider
BCryptCloseAlgorithmProvider
BCryptConfigureContext
BCryptConfigureContextFunction
BCryptCreateContext
BCryptCreateHash
BCryptDecrypt
BCryptDeleteContext
BCryptDeriveKey
BCryptDeriveKeyCapi
BCryptDeriveKeyPBKDF2
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptDuplicateHash
BCryptDuplicateKey
BCryptEncrypt
BCryptEnumAlgorithms
BCryptEnumContextFunctionProviders
BCryptEnumContextFunctions
BCryptEnumContexts
BCryptEnumProviders
BCryptEnumRegisteredProviders
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptFreeBuffer
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptGetFipsAlgorithmMode
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptQueryContextConfiguration
BCryptQueryContextFunctionConfiguration
BCryptQueryContextFunctionProperty
BCryptQueryProviderRegistration
BCryptRegisterConfigChangeNotify
BCryptRegisterProvider
BCryptRemoveContextFunction
BCryptRemoveContextFunctionProvider
BCryptResolveProviders
BCryptSecretAgreement
BCryptSetAuditingInterface
BCryptSetContextFunctionProperty
BCryptSetProperty
BCryptSignHash
BCryptUnregisterConfigChangeNotify
BCryptUnregisterProvider
BCryptVerifySignature

Sections

.MPRESS1
Size: 36KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

894e5d4aaa6a098c923a818ff40d2719

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.MPRESS1 Size: 36KB - Virtual size: 88KB

.MPRESS2 Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.MPRESS1
Size: 36KB - Virtual size: 88KB

.MPRESS2
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB