fa0a5ac020db3febe9f020afd6845a65_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fa0a5ac020db3febe9f020afd6845a65_JaffaCakes118
Size

105KB
MD5

fa0a5ac020db3febe9f020afd6845a65
SHA1

68b59e99340690b0f4f388a30226850fb19fa569
SHA256

b751136e9eba8d5daed57731ca60c189d3b740badaedf2717b952da557c7269d
SHA512

42e19556f30b950a6ad6c9dfa5b7301760aa3fa8e2d47e0c57bb3e8699fd9cde5c4d245d5ff11651c02493f0622b5d47c4f8cad289f82d9558ed8fda04735ef7
SSDEEP

3072:KpO07TslxQ1RzH0kc+i3abIGOXmRwyPKhVh:nnLGR0+IGOXmCyP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa0a5ac020db3febe9f020afd6845a65_JaffaCakes118

Files

fa0a5ac020db3febe9f020afd6845a65_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

977947584b3ddc416ab4c82edeec0c23

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

qmgrprxy.pdb

Imports

msvcrt

_except_handler3
_CxxThrowException
free
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_adjust_fdiv
malloc
__CxxFrameHandler

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrClientCall2
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_CountRefs

oleaut32

BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserFree
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserMarshal

ole32

CoCreateInstance
CLSIDFromString

kernel32

SetUnhandledExceptionFilter
VirtualProtect
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
VirtualAlloc
DisableThreadLibraryCalls

Exports

Exports

ServiceMain
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

977947584b3ddc416ab4c82edeec0c23

Headers

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

oleaut32

ole32

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.orpc Size: 512B - Virtual size: 364B

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 88KB - Virtual size: 88KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.orpc
Size: 512B - Virtual size: 364B

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 88KB - Virtual size: 88KB

.reloc
Size: 1KB - Virtual size: 1KB