fdbeaff07fc94c32d893fac2c0b9653e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fdbeaff07fc94c32d893fac2c0b9653e_JaffaCakes118
Size

115KB
MD5

fdbeaff07fc94c32d893fac2c0b9653e
SHA1

fd08ace7a7d38b19056e1176323401bee74905ff
SHA256

38909d3de259a35b3d071f996f60fa7e5ff06e1cef4af9cd697a4c826abcfd9b
SHA512

44f992d3678ee6916a88b356bce6a45215aa1934ae96d6a6f171a443bc7a6c81d8be9ef4569aa25256c90f4f071cdb5eef346c4efcedc617cc6b0e0991c67ae4
SSDEEP

768:Iu8ECj5rGFFH5K4JXyImcsuMF8WlFYnAFDH+Iv:jacFZKHcsu+TZv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdbeaff07fc94c32d893fac2c0b9653e_JaffaCakes118

Files

fdbeaff07fc94c32d893fac2c0b9653e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

1bf958efb43f89a6815fdff1c45e6d4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapReAlloc
IsBadStringPtrW
RaiseException

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
_strdup
free
fwrite
getenv
memcmp
memmove
strchr
strcmp
strcpy
strcspn
strlen

Exports

Exports

FwpmCalloutAdd0
FwpmCalloutCreateEnumHandle0
FwpmCalloutDeleteById0
FwpmCalloutDeleteByKey0
FwpmCalloutDestroyEnumHandle0
FwpmCalloutEnum0
FwpmCalloutGetById0
FwpmCalloutGetByKey0
FwpmCalloutGetSecurityInfoByKey0
FwpmCalloutSetSecurityInfoByKey0
FwpmCalloutSubscribeChanges0
FwpmCalloutSubscriptionsGet0
FwpmCalloutUnsubscribeChanges0
FwpmDiagnoseNetFailure0
FwpmEngineClose0
FwpmEngineGetOption0
FwpmEngineGetSecurityInfo0
FwpmEngineOpen0
FwpmEngineSetOption0
FwpmEngineSetSecurityInfo0
FwpmEventProviderCreate0
FwpmEventProviderDestroy0
FwpmEventProviderFireNetEvent0
FwpmEventProviderIsNetEventTypeEnabled0
FwpmFilterAdd0
FwpmFilterCreateEnumHandle0
FwpmFilterDeleteById0
FwpmFilterDeleteByKey0
FwpmFilterDestroyEnumHandle0
FwpmFilterEnum0
FwpmFilterGetById0
FwpmFilterGetByKey0
FwpmFilterGetSecurityInfoByKey0
FwpmFilterSetSecurityInfoByKey0
FwpmFilterSubscribeChanges0
FwpmFilterSubscriptionsGet0
FwpmFilterUnsubscribeChanges0
FwpmFreeMemory0
FwpmGetAppIdFromFileName0
FwpmIPsecTunnelAdd0
FwpmIPsecTunnelDeleteByKey0
FwpmLayerCreateEnumHandle0
FwpmLayerDestroyEnumHandle0
FwpmLayerEnum0
FwpmLayerGetById0
FwpmLayerGetByKey0
FwpmLayerGetSecurityInfoByKey0
FwpmLayerSetSecurityInfoByKey0
FwpmNetEventCreateEnumHandle0
FwpmNetEventDestroyEnumHandle0
FwpmNetEventEnum0
FwpmNetEventsGetSecurityInfo0
FwpmNetEventsSetSecurityInfo0
FwpmProviderAdd0
FwpmProviderContextAdd0
FwpmProviderContextCreateEnumHandle0
FwpmProviderContextDeleteById0
FwpmProviderContextDeleteByKey0
FwpmProviderContextDestroyEnumHandle0
FwpmProviderContextEnum0
FwpmProviderContextGetById0
FwpmProviderContextGetByKey0
FwpmProviderContextGetSecurityInfoByKey0
FwpmProviderContextSetSecurityInfoByKey0
FwpmProviderContextSubscribeChanges0
FwpmProviderContextSubscriptionsGet0
FwpmProviderContextUnsubscribeChanges0
FwpmProviderCreateEnumHandle0
FwpmProviderDeleteByKey0
FwpmProviderDestroyEnumHandle0
FwpmProviderEnum0
FwpmProviderGetByKey0
FwpmProviderGetSecurityInfoByKey0
FwpmProviderSetSecurityInfoByKey0
FwpmProviderSubscribeChanges0
FwpmProviderSubscriptionsGet0
FwpmProviderUnsubscribeChanges0
FwpmSessionCreateEnumHandle0
FwpmSessionDestroyEnumHandle0
FwpmSessionEnum0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerDeleteByKey0
FwpmSubLayerDestroyEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerGetByKey0
FwpmSubLayerGetSecurityInfoByKey0
FwpmSubLayerSetSecurityInfoByKey0
FwpmSubLayerSubscribeChanges0
FwpmSubLayerSubscriptionsGet0
FwpmSubLayerUnsubscribeChanges0
FwpmTraceRestoreDefaults0
FwpmTransactionAbort0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpsAleExplicitCredentialsQuery0
FwpsClassifyUser0
FwpsFreeMemory0
FwpsGetInProcReplicaOffset0
FwpsLayerCreateInProcReplica0
FwpsLayerReleaseInProcReplica0
FwpsOpenToken0
IPsecGetStatistics0
IPsecKeyModuleAdd0
IPsecKeyModuleCompleteAcquire0
IPsecKeyModuleDelete0
IPsecSaContextAddInbound0
IPsecSaContextAddOutbound0
IPsecSaContextCreate0
IPsecSaContextCreateEnumHandle0
IPsecSaContextDeleteById0
IPsecSaContextDestroyEnumHandle0
IPsecSaContextEnum0
IPsecSaContextExpire0
IPsecSaContextGetById0
IPsecSaContextGetSpi0
IPsecSaCreateEnumHandle0
IPsecSaDbGetSecurityInfo0
IPsecSaDbSetSecurityInfo0
IPsecSaDestroyEnumHandle0
IPsecSaEnum0
IPsecSaInitiateAsync0
IkeextGetConfigParameters0
IkeextGetStatistics0
IkeextSaCreateEnumHandle0
IkeextSaDbGetSecurityInfo0
IkeextSaDbSetSecurityInfo0
IkeextSaDeleteById0
IkeextSaDestroyEnumHandle0
IkeextSaEnum0
IkeextSaGetById0
IkeextSetConfigParameters0
WSADeleteSocketPeerTargetName
WSAImpersonateSocketPeer
WSAQuerySocketSecurity
WSARevertImpersonation
WSASetSocketPeerTargetName
WSASetSocketSecurity
WfpClearIpsecProposal
WfpFillIkeProposal
WfpFillIpsecProposal
WfpFilterListDestroy
WfpFilterListIpsecTransportV4Create
WfpFilterListIpsecTransportV6Create
WfpGetV4TransportSaSelectors
wfpdiagW

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 160B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 4KB - Virtual size: 114B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/78
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1bf958efb43f89a6815fdff1c45e6d4f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

ucrtbase

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 80B

.rodata Size: 8KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 784B

/4 Size: 4KB - Virtual size: 1KB

.bss Size: - Virtual size: 160B

.edata Size: 16KB - Virtual size: 12KB

.idata Size: 4KB - Virtual size: 724B

.reloc Size: 4KB - Virtual size: 936B

/14 Size: 4KB - Virtual size: 128B

/29 Size: 12KB - Virtual size: 9KB

/41 Size: 4KB - Virtual size: 1KB

/55 Size: 4KB - Virtual size: 3KB

/67 Size: 4KB - Virtual size: 114B

/78 Size: 8KB - Virtual size: 4KB

.text
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 80B

.rodata
Size: 8KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 784B

/4
Size: 4KB - Virtual size: 1KB

.bss
Size: - Virtual size: 160B

.edata
Size: 16KB - Virtual size: 12KB

.idata
Size: 4KB - Virtual size: 724B

.reloc
Size: 4KB - Virtual size: 936B

/14
Size: 4KB - Virtual size: 128B

/29
Size: 12KB - Virtual size: 9KB

/41
Size: 4KB - Virtual size: 1KB

/55
Size: 4KB - Virtual size: 3KB

/67
Size: 4KB - Virtual size: 114B

/78
Size: 8KB - Virtual size: 4KB