f4fa6eff82c29bb7d21bdecab100a920_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f4fa6eff82c29bb7d21bdecab100a920_JaffaCakes118
Size

268KB
MD5

f4fa6eff82c29bb7d21bdecab100a920
SHA1

697116a18aa99bef907a8c14559fbc3130964cfc
SHA256

f156373a27fca7b1f02bbd2bb0bb632fd360fb52e25074f1c701866a29d462b6
SHA512

84c5885e3674201cc4c9806728de716cf2603bed4bfb78232451c4cacf62b384639db09982c8bb4f8e6fafd301935ccc57ad5e794b62cb28e474027a7158305b
SSDEEP

6144:pwuwUpbLFI7xBhs7QWilQa5yOlqOoZ85xCVTqgEen6Uk:pwuXpbcoQWilQ0VH5xCll6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4fa6eff82c29bb7d21bdecab100a920_JaffaCakes118

Files

f4fa6eff82c29bb7d21bdecab100a920_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

17b94e0c129f0274d755971da0485194

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

wsprintfA

Exports

Exports

CreateEnvironmentBlock
CreateProfile
DeleteProfileA
DeleteProfileW
DestroyEnvironmentBlock
DllCanUnloadNow
DllGetClassObject
DllGetContractDescription
DllRegisterServer
DllUnregisterServer
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserA
ExpandEnvironmentStringsForUserW
ForceSyncFgPolicy
FreeGPOListA
FreeGPOListW
GetAllUsersProfileDirectoryA
GetAllUsersProfileDirectoryW
GetAppliedGPOListA
GetAppliedGPOListW
GetDefaultUserProfileDirectoryA
GetDefaultUserProfileDirectoryW
GetGPOListA
GetGPOListW
GetNextFgPolicyRefreshInfo
GetPreviousFgPolicyRefreshInfo
GetProfileType
GetProfilesDirectoryA
GetProfilesDirectoryW
GetUserProfileDirectoryA
GetUserProfileDirectoryW
LeaveCriticalPolicySection
LoadUserProfileA
LoadUserProfileW
ProcessGroupPolicyCompleted
ProcessGroupPolicyCompletedEx
RefreshPolicy
RefreshPolicyEx
RegisterGPNotification
RsopAccessCheckByType
RsopFileAccessCheck
RsopLoggingEnabled
RsopResetPolicySettingStatus
RsopSetPolicySettingStatus
UnloadUserProfile
UnregisterGPNotification
WaitForMachinePolicyForegroundProcessing
WaitForUserPolicyForegroundProcessing

Sections

HookStub
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZeNiX0
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZeNiX1
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17b94e0c129f0274d755971da0485194

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

HookStub Size: 512B - Virtual size: 64B

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 5KB - Virtual size: 8KB

.ZeNiX0 Size: 178KB - Virtual size: 178KB

.ZeNiX1 Size: 45KB - Virtual size: 45KB

.reloc Size: 3KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 494B

HookStub
Size: 512B - Virtual size: 64B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 5KB - Virtual size: 8KB

.ZeNiX0
Size: 178KB - Virtual size: 178KB

.ZeNiX1
Size: 45KB - Virtual size: 45KB

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 494B