faec8fca02d6caf91ad7b7fe9f08bf92_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

faec8fca02d6caf91ad7b7fe9f08bf92_JaffaCakes118
Size

162KB
MD5

faec8fca02d6caf91ad7b7fe9f08bf92
SHA1

e880fc293f356295fa2d1a28fdc982dddbcd274f
SHA256

03cb4e8e0337f2d55ca4ba4bd0a9b342645c496dde583c0234c853a00a1b9006
SHA512

8adf5b74268c182fed5fb709f94abfcf7698cce6d0029972d99c1128ed1aafeceae22dd550fd5f2f44fafe705143c71977d2bfcb64bea323cafc6b61b211674e
SSDEEP

3072:x3urvRaIo4TzA1WscGs85yYC/uGcZpCMejQtpZcCTXys41MJKU0kr:x3soIo4fAoMs85yrsZpCnQtpZLX41uvr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faec8fca02d6caf91ad7b7fe9f08bf92_JaffaCakes118

Files

faec8fca02d6caf91ad7b7fe9f08bf92_JaffaCakes118
.dll windows:5 windows x86 arch:x86

5bf8660137b0e6a344093c6ff340f7bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libxml2

xmlBuildURI
xmlNodeGetBase
xmlXPathNodeSetMerge
xmlXPathObjectCopy
xmlXPathStringFunction
valuePop
xmlXPathWrapNodeSet
xmlXPathNsLookup
xmlSplitQName2
xmlXPathNewString
xmlGetDocEntity
xmlXPathConvertString
xmlXPathNumberFunction
xmlXPathErr
xmlXPathNewCString
xmlXPathCmpNodes
xmlStrstr
xmlXPathNewBoolean
xmlXPathFunctionLookupNS
xmlXPathRegisterFunc
xmlXPathFreeCompExpr
xmlXPathFreeNodeSet
xmlStrncat
xmlStrcat
xmlGetNsList
xmlXPathNodeSetAdd
xmlXPathNodeSetCreate
xmlXPathCastToString
xmlXPathCastNodeToString
xmlXPathCompiledEval
xmlSearchNsByHref
xmlNewNs
xmlStrncmp
xmlBufferCat
xmlCopyCharMultiByte
xmlBufferCCat
xmlIsDigitGroup
xmlCharInRange
xmlIsBaseCharGroup
xmlStrndup
xmlStringCurrentChar
xmlXPathIsNaN
xmlXPathIsInf
xmlXPathFreeParserContext
xmlXPathNextAncestor
xmlXPathNextPrecedingSibling
xmlXPathNewParserContext
xmlBufferFree
xmlXPathEvalExpression
xmlBufferContent
xmlBufferCreate
xmlBufferAdd
xmlUTF8Strpos
xmlUTF8Strloc
xmlStrlen
xmlXPathCtxtCompile
xmlXPathNewContext
xmlRealloc
xmlXPathEval
xmlGetID
xmlIsExtenderGroup
xmlIsCombiningGroup
xmlXPathIsNodeType
xmlHashUpdateEntry3
xmlHashLookup3
xmlHashAddEntry3
xmlCreateURI
xmlXPathEvalPredicate
xmlFreeNode
xmlXPathNewNodeSet
xmlNewDocNode
xmlXPathCompile
xmlStrchr
xmlNewNsProp
xmlFreeNodeList
xmlNewDocProp
__xmlGenericErrorContext
__xmlGenericError
xmlNodeAddContent
xmlStringText
xmlNewTextLen
xmlNewCDataBlock
xmlDictOwns
xmlNodeListGetString
xmlDocCopyNode
xmlNewDocText
xmlNewDocPI
xmlStrcasecmp
xmlUnlinkNode
xmlCreateIntSubset
xmlIsBlankNode
xmlDictQLookup
xmlNewDoc
htmlNewDoc
htmlNewDocNoDtD
xmlURIEscapeStr
xmlNewDocNodeEatName
xmlXPathCompiledEvalToBoolean
xmlXPathNodeSetAddUnique
xmlXPathRegisterFuncLookup
xmlXPathRegisterVariableLookup
xmlXPathContextSetCache
xmlXPathInit
xmlDictCreateSub
xmlFreeDtd
xmlGetIntSubset
xmlFreeRefTable
xmlFreeIDTable
xmlXPathNewValueTree
xmlNodeGetSpacePreserve
xmlNodeSetContent
xmlHashUpdateEntry
xmlAddPrevSibling
xmlValidateNCName
xmlXPathStringEvalNumber
xmlDictCreate
xmlGetDtdAttrDesc
xmlGetProp
xmlGetLineNo
xmlXPathConvertNumber
xmlStrcmp
xmlNodeDumpOutput
xmlGetCharEncodingName
xmlBufferWriteQuotedString
xmlOutputBufferWriteString
htmlDocContentDumpOutput
xmlOutputBufferFlush
htmlDocContentDumpFormatOutput
htmlSetMetaEncoding
xmlOutputBufferClose
xmlFindCharEncodingHandler
xmlOutputBufferCreateFilename
xmlOutputBufferCreateFile
xmlOutputBufferCreateFd
xmlAllocOutputBuffer
xmlSetProp
xmlNewChild
xmlDocSetRootElement
valuePush
xmlParseURI
xmlSaveUri
xmlFreeURI
xmlXPtrNewContext
xmlXPtrEval
xmlXPathFreeContext
xmlXPathFreeObject
xmlXPathDebugDumpObject
xmlNewComment
xmlAddChild
xmlHashRemoveEntry2
xmlHashRemoveEntry
xmlHashScan
xmlHashLookup
xmlHashAddEntry
xmlXPathRegisterFuncNS
xmlXIncludeProcessFlags
xmlDocGetRootElement
xmlXPathOrderDocElems
xmlNewParserCtxt
xmlDictFree
xmlDictReference
xmlCtxtUseOptions
xmlLoadExternalEntity
xmlFreeParserCtxt
inputPush
xmlParserGetDirectory
xmlParseDocument
xmlFreeDoc
xmlValidateQName
xmlSearchNs
xmlStrncasecmp
xmlHasNsProp
xmlStrdup
xmlSetNsProp
xmlNewText
xmlStringTextNoenc
xmlHashScanFull
xmlHashFree
xmlHashAddEntry2
xmlGetNsProp
xmlHashCreate
xmlHashLookup2
xmlStrEqual
xmlHashUpdateEntry2
xmlDictLookup
xmlFree
xmlNodeGetContent
xmlMalloc

msvcr90

_except_handler4_common
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_vsnprintf
vfprintf
strncmp
_mkdir
_stat64i32
sscanf
memset
_CIpow
floor
_CIfmod
memcpy
_snprintf
sprintf
__iob_func
fprintf
_onexit

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileAttributesA
GetSystemTimeAsFileTime

Exports

Exports

xslAddCall
xslDebugStatus
xslDropCall
xslHandleDebugger
xsltAddKey
xsltAddStackElemList
xsltAddTemplate
xsltAllocateExtra
xsltAllocateExtraCtxt
xsltApplyAttributeSet
xsltApplyImports
xsltApplyOneTemplate
xsltApplyStripSpaces
xsltApplyStylesheet
xsltApplyStylesheetUser
xsltApplyTemplates
xsltAttrListTemplateProcess
xsltAttrTemplateProcess
xsltAttrTemplateValueProcess
xsltAttrTemplateValueProcessNode
xsltAttribute
xsltCalibrateAdjust
xsltCallTemplate
xsltCheckExtPrefix
xsltCheckExtURI
xsltCheckRead
xsltCheckWrite
xsltChoose
xsltCleanupGlobals
xsltCleanupTemplates
xsltComment
xsltCompileAttr
xsltCompilePattern
xsltComputeSortResult
xsltCopy
xsltCopyNamespace
xsltCopyNamespaceList
xsltCopyOf
xsltCopyTextString
xsltCreateRVT
xsltDebug
xsltDebugDumpExtensions
xsltDebugGetDefaultTrace
xsltDebugSetDefaultTrace
xsltDecimalFormatGetByName
xsltDefaultSortFunction
xsltDoSortFunction
xsltDocDefaultLoader
xsltDocumentComp
xsltDocumentElem
xsltDocumentFunction
xsltDocumentSortFunction
xsltElement
xsltElementAvailableFunction
xsltEngineVersion
xsltEvalAVT
xsltEvalAttrValueTemplate
xsltEvalGlobalVariables
xsltEvalOneUserParam
xsltEvalStaticAttrValueTemplate
xsltEvalTemplateString
xsltEvalUserParams
xsltEvalXPathPredicate
xsltEvalXPathString
xsltEvalXPathStringNs
xsltExtElementLookup
xsltExtModuleElementLookup
xsltExtModuleElementPreComputeLookup
xsltExtModuleFunctionLookup
xsltExtModuleTopLevelLookup
xsltExtensionInstructionResultFinalize
xsltExtensionInstructionResultRegister
xsltFindDocument
xsltFindElemSpaceHandling
xsltFindTemplate
xsltForEach
xsltFormatNumberConversion
xsltFormatNumberFunction
xsltFreeAVTList
xsltFreeAttributeSetsHashes
xsltFreeCompMatchList
xsltFreeCtxtExts
xsltFreeDocumentKeys
xsltFreeDocuments
xsltFreeExts
xsltFreeGlobalVariables
xsltFreeKeys
xsltFreeNamespaceAliasHashes
xsltFreeRVTs
xsltFreeSecurityPrefs
xsltFreeStackElemList
xsltFreeStyleDocuments
xsltFreeStylePreComps
xsltFreeStylesheet
xsltFreeTemplateHashes
xsltFreeTransformContext
xsltFunctionAvailableFunction
xsltFunctionNodeSet
xsltGenerateIdFunction
xsltGenericDebug
xsltGenericDebugContext
xsltGenericError
xsltGenericErrorContext
xsltGetCNsProp
xsltGetDebuggerStatus
xsltGetDefaultSecurityPrefs
xsltGetExtData
xsltGetExtInfo
xsltGetKey
xsltGetNamespace
xsltGetNsProp
xsltGetPlainNamespace
xsltGetProfileInformation
xsltGetQNameURI
xsltGetQNameURI2
xsltGetSecurityPrefs
xsltGetSpecialNamespace
xsltGetTemplate
xsltGetUTF8Char
xsltGetXIncludeDefault
xsltIf
xsltInit
xsltInitAllDocKeys
xsltInitCtxtExts
xsltInitCtxtKey
xsltInitCtxtKeys
xsltInitElemPreComp
xsltIsBlank
xsltKeyFunction
xsltLibxmlVersion
xsltLibxsltVersion
xsltLoadDocument
xsltLoadStyleDocument
xsltLoadStylesheetPI
xsltLocalVariablePop
xsltLocalVariablePush
xsltMaxDepth
xsltMessage
xsltNamespaceAlias
xsltNeedElemSpaceHandling
xsltNewDocument
xsltNewElemPreComp
xsltNewSecurityPrefs
xsltNewStyleDocument
xsltNewStylesheet
xsltNewTransformContext
xsltNextImport
xsltNormalizeCompSteps
xsltNumber
xsltNumberFormat
xsltParseGlobalParam
xsltParseGlobalVariable
xsltParseStylesheetAttributeSet
xsltParseStylesheetCallerParam
xsltParseStylesheetDoc
xsltParseStylesheetFile
xsltParseStylesheetImport
xsltParseStylesheetImportedDoc
xsltParseStylesheetInclude
xsltParseStylesheetOutput
xsltParseStylesheetParam
xsltParseStylesheetProcess
xsltParseStylesheetVariable
xsltParseTemplateContent
xsltPreComputeExtModuleElement
xsltPrintErrorContext
xsltProcessingInstruction
xsltProfileStylesheet
xsltQuoteOneUserParam
xsltQuoteUserParams
xsltRegisterAllElement
xsltRegisterAllExtras
xsltRegisterAllFunctions
xsltRegisterExtElement
xsltRegisterExtFunction
xsltRegisterExtModule
xsltRegisterExtModuleElement
xsltRegisterExtModuleFull
xsltRegisterExtModuleFunction
xsltRegisterExtModuleTopLevel
xsltRegisterExtPrefix
xsltRegisterExtras
xsltRegisterLocalRVT
xsltRegisterPersistRVT
xsltRegisterTestModule
xsltRegisterTmpRVT
xsltReleaseRVT
xsltResolveStylesheetAttributeSet
xsltRunStylesheet
xsltRunStylesheetUser
xsltSaveProfiling
xsltSaveResultTo
xsltSaveResultToFd
xsltSaveResultToFile
xsltSaveResultToFilename
xsltSaveResultToString
xsltSecurityAllow
xsltSecurityForbid
xsltSetCtxtParseOptions
xsltSetCtxtSecurityPrefs
xsltSetCtxtSortFunc
xsltSetDebuggerCallbacks
xsltSetDebuggerStatus
xsltSetDefaultSecurityPrefs
xsltSetGenericDebugFunc
xsltSetGenericErrorFunc
xsltSetLoaderFunc
xsltSetSecurityPrefs
xsltSetSortFunc
xsltSetTransformErrorFunc
xsltSetXIncludeDefault
xsltShutdownCtxtExts
xsltShutdownExts
xsltSort
xsltSplitQName
xsltStyleGetExtData
xsltStylePreCompute
xsltSystemPropertyFunction
xsltTemplateProcess
xsltTestCompMatchList
xsltText
xsltTimestamp
xsltTransformError
xsltUninit
xsltUnparsedEntityURIFunction
xsltUnregisterExtModule
xsltUnregisterExtModuleElement
xsltUnregisterExtModuleFunction
xsltUnregisterExtModuleTopLevel
xsltValueOf
xsltVariableLookup
xsltXPathCompile
xsltXPathFunctionLookup
xsltXPathGetTransformContext
xsltXPathVariableLookup

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5bf8660137b0e6a344093c6ff340f7bc

Headers

File Characteristics

Imports

libxml2

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 112KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 112KB - Virtual size: 112KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 6KB - Virtual size: 6KB