fab7de9eafea67f88e43003698024c86_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fab7de9eafea67f88e43003698024c86_JaffaCakes118
Size

26KB
MD5

fab7de9eafea67f88e43003698024c86
SHA1

24a4ef27c29cdeabed5e0af867e3f568da40d0c9
SHA256

073b1f99871dc56a33dcd55af71d53482816bfc9b3ce5c78ee53bed31b428384
SHA512

b4a57a8cc564760526d4cce26ce24e80657c064df373c307bb90cf053d01d04bdfe1def41fedfeb7715e53d8481a98c94bc6f3bf33815b4571d898aa08553fcd
SSDEEP

768:pRUPyb1nMEkpsCE5majoA8vqKioFSS7fhykz:pRUPyKNvEls57f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fab7de9eafea67f88e43003698024c86_JaffaCakes118

Files

fab7de9eafea67f88e43003698024c86_JaffaCakes118
.dll windows:5 windows x64 arch:x64

dc69443f848f84a81abb57ae05def426

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

memset
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwCreateEventPair
wcscpy
LdrFindEntryForAddress
ZwCreateEvent
ZwQueryInformationToken
ZwOpenProcessToken
RtlExpandEnvironmentStrings_U
RtlFreeUnicodeString
ZwQueryValueKey
ZwOpenKey
RtlFormatCurrentUserKeyPath
RtlImageNtHeader
ZwQueryVolumeInformationFile
ZwOpenEvent
ZwWriteFile
ZwClose
ZwReadFile
RtlInitUnicodeString
ZwOpenFile
wcscat
wcsrchr
LdrGetProcedureAddress
swprintf
wcslen
RtlExitUserThread
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlNtStatusToDosError
ZwCreateSection
ZwMapViewOfSection
RtlComputeCrc32
RtlAddressInSectionTable
ZwSetInformationFile
ZwSetEaFile
ZwCreateFile
ZwDeleteFile
wcstoul
ZwQueryDirectoryFile
ZwQueryEaFile
qsort
RtlTimeToSecondsSince1980
memcpy
ZwUnmapViewOfSection
__C_specific_handler
__chkstk

kernel32

LeaveCriticalSection
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
DeleteTimerQueueTimer
CreateTimerQueueTimer
CreateThread
DisableThreadLibraryCalls
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
SleepEx
Sleep
FreeLibrary
LoadLibraryW
VirtualFree
EnterCriticalSection
LoadLibraryA
VirtualAlloc

advapi32

CryptDestroyKey
CryptDestroyHash
CryptVerifySignatureW
CryptSetHashParam
CryptCreateHash
CryptReleaseContext
MD5Init
CryptGenRandom
CryptImportKey
CryptAcquireContextW
MD5Final
MD5Update

mswsock

AcceptEx

ws2_32

setsockopt
WSASend
WSARecv
WSAIoctl
listen
WSASendTo
closesocket
WSAGetLastError
WSASocketW
WSACleanup
WSAStartup
bind
WSARecvFrom

Exports

Exports

DllGetClassObject

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc69443f848f84a81abb57ae05def426

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

mswsock

ws2_32

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 7KB

.pdata Size: 1024B - Virtual size: 780B

.reloc Size: 512B - Virtual size: 196B

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 7KB

.pdata
Size: 1024B - Virtual size: 780B

.reloc
Size: 512B - Virtual size: 196B