ee940020bcd2f07b0afc24fe03a33f35_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ee940020bcd2f07b0afc24fe03a33f35_JaffaCakes118
Size

192KB
MD5

ee940020bcd2f07b0afc24fe03a33f35
SHA1

9a2c441d0f9b727ba3f1ace226a6927cf75989e0
SHA256

66109eea97432bb20c5181151c983bb32b18b1dff3735feaf0b762a1d52ba262
SHA512

f0ea65ab920364b277e89b3509492a34b54e26cf4cb8898511854612ea4521263487e475595599b41336e151466fb37fe315d870403ee95ebf9a386d6ed9fd7a
SSDEEP

3072:Pl4890aJJibWimPohw4wlOyFsd5mwn1XZS7/nunRwyPvLQRkdmieIe8:Pl4890aJJOWHPywVlOyFeS7KvPv0RkbS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee940020bcd2f07b0afc24fe03a33f35_JaffaCakes118

Files

ee940020bcd2f07b0afc24fe03a33f35_JaffaCakes118
.dll windows:5 windows x86 arch:x86

c38c35a8a8987f5f6860268361232a0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\client_rn\viewsource\rel32\vsrlocal.pdb

Imports

user32

CharNextA
GetSystemMetrics

msvcr90

isxdigit
strtoul
strstr
strncmp
_ismbblead
memcpy
isalpha
isspace
tolower
isupper
memmove
_time32
toupper
rand
srand
iscntrl
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
strtol
atol
isdigit
strchr
strncpy
strrchr
memset
qsort
strtok
asctime
_gmtime32
_strnicmp
_stricmp
??3@YAXPAX@Z
sprintf
??_V@YAXPAX@Z
??2@YAPAXI@Z
_putenv
_vsnprintf
_purecall
_unlock

kernel32

LoadLibraryA
GetProcAddress
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Exports

Exports

CanUnload
RMACreateInstance
SetDLLAccessPath

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c38c35a8a8987f5f6860268361232a0b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 101KB - Virtual size: 100KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 101KB - Virtual size: 100KB

.reloc
Size: 5KB - Virtual size: 5KB