f01b950d84e3d23855fc1f83850dfae2_JaffaCakes118

General

Target

f01b950d84e3d23855fc1f83850dfae2_JaffaCakes118
Size

10KB
MD5

f01b950d84e3d23855fc1f83850dfae2
SHA1

b2d29c9c5ab5a8d1eaa663c9dec8a864372816ff
SHA256

4322b2e1d35937ef2776db0e234cde51c447571c13da1443bf29ac59c7309000
SHA512

b1941315b5f9ffb32e8bc1ea6e5f76e910ea2b75d633a84a5b8c728b3fbb10cea124434e305160640dd594cd3a3b791c5f5faadf6316bd3deadaaecd2d984016
SSDEEP

192:BJoIamBZJTiMgAErX3aOtGT6z2JaWOT/WWHp:bvlilAs6OtG6WOT/WWJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f01b950d84e3d23855fc1f83850dfae2_JaffaCakes118

Files

f01b950d84e3d23855fc1f83850dfae2_JaffaCakes118
.dll windows:6 windows x86 arch:x86

705fb4b7b95340a6ee8e7ae9aa55d341

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

acproxy.pdb

Imports

msvcrt

_except_handler4_common
_XcptFilter
_amsg_exit
_initterm
free
malloc

ntdll

WinSqmIsOptedInEx
RtlFreeHeap
RtlAllocateHeap

kernel32

TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentProcess
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
GetTickCount
Sleep
GetLastError
CloseHandle
ReadFile
CreateFileW
FindVolumeClose
DeleteFileW
GetDriveTypeW
FindNextVolumeW
FindFirstVolumeW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource

ulib

??0DSTRING@@QAE@XZ
?UploadSqmFromFile@SQMEXPORT@@SGEPAX@Z
??1DSTRING@@UAE@XZ
??1HMEM@@UAE@XZ
??1OBJECT@@UAE@XZ
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Resize@HMEM@@QAEEKK@Z
?Initialize@FSTRING@@QAEPAVWSTRING@@PAGK@Z
?Acquire@HMEM@@UAEPAXKK@Z
?Initialize@HMEM@@QAEEXZ
??0FSTRING@@QAE@XZ
??0HMEM@@QAE@XZ

Exports

Exports

PerformAutochkOperations

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

705fb4b7b95340a6ee8e7ae9aa55d341

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

ulib

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 844B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 470B

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 844B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 470B