fb70119134aafba89bc20cd8097af9f6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fb70119134aafba89bc20cd8097af9f6_JaffaCakes118
Size

112KB
MD5

fb70119134aafba89bc20cd8097af9f6
SHA1

7dd950d75be2553f723fa30a8ff5850a41660c23
SHA256

0324c2b86cc6781c2b9affd0369476e25a91bdb22764fb11d34081cea04c7003
SHA512

23a1ea8e19bfe64a177fddf3b521ea753f2df0ef123e2db6cd912008d9f01fb42e273ee9e5ecadb0d3309744cec221bceaa41e43e4dc38cadc7884cf3c98cd5b
SSDEEP

1536:DxsqDwCgTYzzZvurOZy3ngvfnyDLlxFbw74woaULZ5REazMaA06Y7L+TU:D2JEzzO9nGWLlxFbgZ2Z5RCaAHTU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb70119134aafba89bc20cd8097af9f6_JaffaCakes118

Files

fb70119134aafba89bc20cd8097af9f6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

71cd5eb52e97fc1f44c87e966212b9d0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

xmltok

XmlPrologStateInitExternalEntity
XmlGetUtf8InternalEncodingNS
XmlPrologStateInit
XmlGetUtf8InternalEncoding
XmlUtf8Encode
XmlParseXmlDeclNS
XmlParseXmlDecl
XmlInitEncodingNS
XmlInitEncoding
XmlSizeOfUnknownEncoding
XmlInitUnknownEncodingNS
XmlInitUnknownEncoding

kernel32

GetModuleFileNameA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetLastError
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
DisableThreadLibraryCalls
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
QueryPerformanceCounter

Exports

Exports

XML_DefaultCurrent
XML_ErrorString
XML_ExternalEntityParserCreate
XML_GetBase
XML_GetBuffer
XML_GetCurrentByteCount
XML_GetCurrentByteIndex
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_GetErrorCode
XML_GetIdAttributeIndex
XML_GetSpecifiedAttributeCount
XML_Parse
XML_ParseBuffer
XML_ParserCreate
XML_ParserCreateNS
XML_ParserFree
XML_SetBase
XML_SetCdataSectionHandler
XML_SetCharacterDataHandler
XML_SetCommentHandler
XML_SetDefaultHandler
XML_SetDefaultHandlerExpand
XML_SetDoctypeDeclHandler
XML_SetElementHandler
XML_SetEncoding
XML_SetExternalEntityRefHandler
XML_SetExternalEntityRefHandlerArg
XML_SetExternalParsedEntityDeclHandler
XML_SetInternalParsedEntityDeclHandler
XML_SetNamespaceDeclHandler
XML_SetNotStandaloneHandler
XML_SetNotationDeclHandler
XML_SetParamEntityParsing
XML_SetProcessingInstructionHandler
XML_SetUnknownEncodingHandler
XML_SetUnparsedEntityDeclHandler
XML_SetUserData
XML_UseParserAsHandlerArg

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71cd5eb52e97fc1f44c87e966212b9d0

Headers

File Characteristics

Imports

xmltok

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 56KB - Virtual size: 54KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 56KB - Virtual size: 54KB

.reloc
Size: 4KB - Virtual size: 1KB