ee852af56f298651ec55d66146d20d57_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ee852af56f298651ec55d66146d20d57_JaffaCakes118
Size

189KB
MD5

ee852af56f298651ec55d66146d20d57
SHA1

2c9ba798ea3a48521710002d1161d2c3eaa2dea1
SHA256

0800782d77224bc38bdaf9947a3643ac4f50907f32e43f49d984de7c9f9e1a35
SHA512

accb100fa576ce188d456a54c0ba206429399c078cfc554509a4d1a3387f846ac681548425fdcb28bea03928de12b40ded7f494269bc5c2054b73dc9993f1584
SSDEEP

3072:XKkDnY7eN8boyAbraN+1dGX4oAAmnIZ63DVszZuDRR7p3ACxLfH18:6kDXNFyAbWN+1dC8VSuDf7zxL2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee852af56f298651ec55d66146d20d57_JaffaCakes118

Files

ee852af56f298651ec55d66146d20d57_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3711ec1619e55a78c8a612a45d6b8d9f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby220

Sleep@4
clock_gettime
localtime_r
rb_ary_new_capa
rb_ary_new_from_args
rb_ary_push
rb_backref_get
rb_backref_set
rb_block_given_p
rb_cFalseClass
rb_cFixnum
rb_cNilClass
rb_cNumeric
rb_cObject
rb_cRational
rb_cSymbol
rb_cTime
rb_cTrueClass
rb_check_typeddata
rb_copy_generic_ivar
rb_cstr_to_inum
rb_data_typed_object_alloc
rb_define_alloc_func
rb_define_class
rb_define_const
rb_define_method
rb_define_private_method
rb_define_singleton_method
rb_eArgError
rb_eTypeError
rb_enc_copy
rb_enc_dummy_p
rb_enc_get
rb_enc_sprintf
rb_enumeratorize_with_size
rb_error_frozen_object
rb_f_sprintf
rb_float_new
rb_float_value
rb_frame_this_func
rb_funcall
rb_gc_mark
rb_gc_register_mark_object
rb_gc_writebarrier_generational
rb_gc_writebarrier_incremental
rb_gc_writebarrier_unprotect
rb_hash_aref
rb_hash_aset
rb_hash_delete
rb_hash_new
rb_id2sym
rb_include_module
rb_int2big
rb_intern
rb_intern2
rb_islower
rb_isupper
rb_ll2inum
rb_mComparable
rb_marshal_load
rb_match_busy
rb_memhash
rb_num2dbl
rb_num2long
rb_num_coerce_cmp
rb_obj_class
rb_obj_classname
rb_obj_freeze
rb_obj_is_kind_of
rb_raise
rb_rational_den
rb_rational_new
rb_rational_num
rb_reg_new
rb_reg_nth_match
rb_scan_args
rb_str_append
rb_str_cat
rb_str_dup
rb_str_format
rb_str_new
rb_str_new_cstr
rb_str_new_static
rb_str_to_inum
rb_string_value
rb_string_value_cstr
rb_sym2id
rb_sys_fail
rb_tolower
rb_toupper
rb_uint2big
rb_undef_method
rb_usascii_encoding
rb_usascii_str_new
rb_usascii_str_new_cstr
rb_usascii_str_new_static
rb_warning
rb_yield
ruby_snprintf
ruby_xcalloc
ruby_xfree
ruby_xmalloc
strlcpy

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

_timezone
_tzset
__dllonexit
_amsg_exit
_errno
_initterm
_iob
_lock
_mktime64
_onexit
_strnicmp
_time64
_unlock
abort
calloc
ceil
floor
free
fwrite
isalpha
isspace
malloc
memchr
memcpy
memmove
memset
strchr
strcpy
strlen
strncmp
strpbrk
strspn
strtoul
tolower
vfprintf

Exports

Exports

Init_date_core

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3711ec1619e55a78c8a612a45d6b8d9f

Headers

File Characteristics

Imports

msvcrt-ruby220

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 160KB

.data Size: 512B - Virtual size: 480B

.rdata Size: 12KB - Virtual size: 11KB

.bss Size: - Virtual size: 3KB

.edata Size: 512B - Virtual size: 78B

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 160KB - Virtual size: 160KB

.data
Size: 512B - Virtual size: 480B

.rdata
Size: 12KB - Virtual size: 11KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 78B

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 9KB - Virtual size: 8KB