fe756584b159fd24dc4b6a572917354c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fe756584b159fd24dc4b6a572917354c_JaffaCakes118
Size

72KB
MD5

fe756584b159fd24dc4b6a572917354c
SHA1

0a3dcb8b7784cf76826651af3c2713d12fa46a62
SHA256

17b7ad3434a9ce3ce31978a6822be271a7fe0b45bff47adc6b1e2d04238ec4be
SHA512

f192217f9da5bab12d840469f4bf4678a142e6af2bc5f8c8c4fd51098ed7e5c914320c250f483914a77892b13f0c90baaf069de184f4ce54213b87ab59bc29f2
SSDEEP

768:qHo/VzWjgVSmiXDy9B6DTd1YfyNlIrEXP73WTWCk:qHonQDwGTdkCWEivk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe756584b159fd24dc4b6a572917354c_JaffaCakes118

Files

fe756584b159fd24dc4b6a572917354c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

48543a709489a7fb0ada5149ac24a97b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
memset
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwCreateEventPair
LdrFindEntryForAddress
ZwCreateEvent
ZwQueryInformationToken
ZwOpenProcessToken
RtlConvertSidToUnicodeString
RtlAppendUnicodeToString
memcpy
RtlNtStatusToDosError
ZwOpenEvent
ZwWriteFile
ZwClose
ZwReadFile
RtlInitUnicodeString
ZwOpenFile
wcscat
wcscpy
wcsrchr
LdrGetProcedureAddress
swprintf
wcslen
RtlExitUserThread
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
RtlComputeCrc32
RtlAddressInSectionTable
ZwSetInformationFile
ZwSetEaFile
ZwCreateFile
ZwDeleteFile
wcstoul
ZwQueryDirectoryFile
ZwQueryEaFile
qsort
ZwQueryVolumeInformationFile
RtlTimeToSecondsSince1980
RtlUnwind
NtQueryVirtualMemory

kernel32

LeaveCriticalSection
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
LocalFree
LocalAlloc
DeleteTimerQueueTimer
CreateTimerQueueTimer
CreateThread
DisableThreadLibraryCalls
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
SleepEx
Sleep
FreeLibrary
LoadLibraryW
VirtualFree
EnterCriticalSection
LoadLibraryA
VirtualAlloc

advapi32

CryptDestroyKey
CryptDestroyHash
CryptVerifySignatureW
CryptSetHashParam
CryptCreateHash
CryptReleaseContext
MD5Init
CryptGenRandom
CryptImportKey
CryptAcquireContextW
MD5Final
MD5Update

mswsock

AcceptEx

ws2_32

setsockopt
WSASend
WSARecv
WSAIoctl
listen
WSASendTo
closesocket
WSAGetLastError
WSASocketW
WSACleanup
WSAStartup
bind
WSARecvFrom

Exports

Exports

DllGetClassObject

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48543a709489a7fb0ada5149ac24a97b

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

mswsock

ws2_32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 6KB - Virtual size: 6KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1KB - Virtual size: 1KB