feb032bb1e130a37f4b32ced2f481b2b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

feb032bb1e130a37f4b32ced2f481b2b_JaffaCakes118
Size

175KB
MD5

feb032bb1e130a37f4b32ced2f481b2b
SHA1

38febc29d1ed566c18df6ed5cdf783891c54fc4b
SHA256

4e77d0538bb7fa536b2988c227794017ecea57d8acec10983d0a10bb1fb1c048
SHA512

0602a835fb85e03d8eadec562d6f98f399507f74b69e15855d8073b9311c43d8bf0e3a4f087b244e6bea25616839f2ff4426e74e9bcb8030f2090735fa9d6172
SSDEEP

3072:9DyjFBMlJsee5pGjndbDyjFBMlJsee5pGjndbDyjFBMlJsee5pGjnd:9DyjFncJbDyjFncJbDyjFncJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
feb032bb1e130a37f4b32ced2f481b2b_JaffaCakes118

Files

feb032bb1e130a37f4b32ced2f481b2b_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e566b5e1afbaca6e9905feda4cf65fa9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
OutputDebugStringA
GetSystemTimeAsFileTime

libxml2

xmlNewNs
xmlNewDoc
xmlSaveToBuffer
xmlBufferCreate
xmlCleanupParser
xmlFreeMutex
xmlNewMutex
xmlInitParser
xmlStrcmp
xmlFree
xmlNodeGetContent
xmlGetProp
xmlMutexUnlock
xmlSearchNsByHref
xmlDocGetRootElement
xmlParseMemory
xmlMutexLock
xmlFreeNode
xmlNodeSetContent
xmlNewProp
xmlNewNode
xmlFreeDoc
xmlBufferFree
xmlSaveClose
xmlFreeNs
xmlBufferContent
xmlBufferLength
xmlSaveFlush
xmlSaveDoc
xmlAddChild
xmlReconciliateNs

tucl-1

TcLog

msvcrt

strchr
strcmp
strcat
sprintf
calloc
free
strlen
strncpy
tolower
memset
strspn
_access
memmove
realloc
malloc
strncmp
strtol
isspace
strtoul
strcpy
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
_errno
strcspn

Exports

Exports

Boolean_List_marshal
Boolean_marshal
Boolean_type
Buffer_List_marshal
Buffer_marshal
Buffer_type
Config_create
Config_delete
Config_duplicate
Config_getConfigVersion
Config_getConstants
Config_getID
Config_getInputParams
Config_getName
Config_getNamespaceUri
Config_getOutputParams
Config_getSchemaVersion
Config_getVersion
Config_marshal
Config_printUsage
Config_setConstants
Config_setInputParams
Config_setOutputParams
Config_unmarshal
FinalizeXMLUnmarshal
IPv4_List_marshal
IPv4_marshal
IPv4_type
IPv6_List_marshal
IPv6_marshal
IPv6_type
InitializeXMLUnmarshal
List_format
LocalFile_List_marshal
LocalFile_marshal
LocalFile_type
Paramchoice_addParamgroup
Paramchoice_create
Paramchoice_delete
Paramchoice_getDefaultValue
Paramchoice_getDescription
Paramchoice_getName
Paramchoice_getNumParamgroups
Paramchoice_getParamgroup
Paramchoice_getValue
Paramchoice_hasValidValue
Paramchoice_hasValue
Paramchoice_isValid
Paramchoice_matchName
Paramchoice_setValue
Parameter_Boolean_List_create
Parameter_Boolean_List_getSize
Parameter_Boolean_List_getValue
Parameter_Boolean_List_setValue
Parameter_Boolean_create
Parameter_Boolean_getValue
Parameter_Boolean_setValue
Parameter_Buffer_List_create
Parameter_Buffer_List_getSize
Parameter_Buffer_List_getValue
Parameter_Buffer_List_setValue
Parameter_Buffer_create
Parameter_Buffer_getValue
Parameter_Buffer_setValue
Parameter_IPv4_List_create
Parameter_IPv4_List_getSize
Parameter_IPv4_List_getValue
Parameter_IPv4_List_setValue
Parameter_IPv4_create
Parameter_IPv4_getValue
Parameter_IPv4_setValue
Parameter_IPv6_List_create
Parameter_IPv6_List_getSize
Parameter_IPv6_List_getValue
Parameter_IPv6_List_setValue
Parameter_IPv6_create
Parameter_IPv6_getValue
Parameter_IPv6_setValue
Parameter_LocalFile_List_create
Parameter_LocalFile_List_getSize
Parameter_LocalFile_List_getValue
Parameter_LocalFile_List_setValue
Parameter_LocalFile_create
Parameter_LocalFile_getValue
Parameter_LocalFile_setValue
Parameter_Port_List_getSize
Parameter_Port_List_getValue
Parameter_Port_List_setValue
Parameter_Port_getValue
Parameter_Port_setValue
Parameter_S16_List_create
Parameter_S16_List_getSize
Parameter_S16_List_getValue
Parameter_S16_List_setValue
Parameter_S16_create
Parameter_S16_getValue
Parameter_S16_setValue
Parameter_S32_List_create
Parameter_S32_List_getSize
Parameter_S32_List_getValue
Parameter_S32_List_setValue
Parameter_S32_create
Parameter_S32_getValue
Parameter_S32_setValue
Parameter_S64_List_create
Parameter_S64_List_getSize
Parameter_S64_List_getValue
Parameter_S64_List_setValue
Parameter_S64_create
Parameter_S64_getValue
Parameter_S64_setValue
Parameter_S8_List_create
Parameter_S8_List_getSize
Parameter_S8_List_getValue
Parameter_S8_List_setValue
Parameter_S8_create
Parameter_S8_getValue
Parameter_S8_setValue
Parameter_Socket_List_create
Parameter_Socket_List_getSize
Parameter_Socket_List_getValue
Parameter_Socket_List_setValue
Parameter_Socket_create
Parameter_Socket_getValue
Parameter_Socket_setValue
Parameter_String_List_create
Parameter_String_List_getSize
Parameter_String_List_getValue
Parameter_String_List_setValue
Parameter_String_create
Parameter_String_getValue
Parameter_String_setValue
Parameter_TcpPort_List_create
Parameter_TcpPort_create
Parameter_U16_List_create
Parameter_U16_List_getSize
Parameter_U16_List_getValue
Parameter_U16_List_setValue
Parameter_U16_create
Parameter_U16_getValue
Parameter_U16_setValue
Parameter_U32_List_create
Parameter_U32_List_getSize
Parameter_U32_List_getValue
Parameter_U32_List_setValue
Parameter_U32_create
Parameter_U32_getValue
Parameter_U32_setValue
Parameter_U64_List_create
Parameter_U64_List_getSize
Parameter_U64_List_getValue
Parameter_U64_List_setValue
Parameter_U64_create
Parameter_U64_getValue
Parameter_U64_setValue
Parameter_U8_List_create
Parameter_U8_List_getSize
Parameter_U8_List_getValue
Parameter_U8_List_setValue
Parameter_U8_create
Parameter_U8_getValue
Parameter_U8_setValue
Parameter_UString_List_create
Parameter_UString_List_getSize
Parameter_UString_List_getValue
Parameter_UString_List_setValue
Parameter_UString_create
Parameter_UString_getValue
Parameter_UString_setValue
Parameter_UdpPort_List_create
Parameter_UdpPort_create
Parameter_delete
Parameter_getDescription
Parameter_getFormat
Parameter_getInvalidReason
Parameter_getMarshalledDefault
Parameter_getMarshalledValue
Parameter_getName
Parameter_getType
Parameter_hasValidValue
Parameter_hasValue
Parameter_hide
Parameter_isHidden
Parameter_isRequired
Parameter_isValid
Parameter_markInvalid
Parameter_markInvalidWithReason
Parameter_matchFormat
Parameter_matchFormatAndType
Parameter_matchName
Parameter_matchType
Parameter_resetValue
Parameter_setMarshalledValue
Paramgroup_addParamchoice
Paramgroup_addParameter
Paramgroup_create
Paramgroup_delete
Paramgroup_getDescription
Paramgroup_getName
Paramgroup_getNumParamchoices
Paramgroup_getNumParameters
Paramgroup_getParamchoice
Paramgroup_getParameter
Paramgroup_isValid
Paramgroup_matchName
Paramgroup_removeParameter
Params_addParamchoice
Params_addParameter
Params_create
Params_delete
Params_duplicate
Params_findParamchoice
Params_findParameter
Params_getCallbackIPv4Values
Params_getCallbackIPv6Values
Params_getCallbackPortValues
Params_getName
Params_getNumParamchoices
Params_getNumParameters
Params_getParamchoice
Params_getParameter
Params_isValid
Params_parseCommandLine
Params_printInvalid
Params_removeParameter
Params_validateCallbackPorts
Port_List_marshal
Port_marshal
S16_List_marshal
S16_marshal
S16_type
S32_List_marshal
S32_marshal
S32_type
S64_List_marshal
S64_marshal
S64_type
S8_List_marshal
S8_marshal
S8_type
Scalar_format
Socket_List_marshal
Socket_marshal
Socket_type
String_List_marshal
String_marshal
String_type
TcpPort_type
U16_List_marshal
U16_marshal
U16_type
U32_List_marshal
U32_marshal
U32_type
U64_List_marshal
U64_marshal
U64_type
U8_List_marshal
U8_marshal
U8_type
UString_List_marshal
UString_marshal
UString_type
UdpPort_type
freeMarshalledValue

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e566b5e1afbaca6e9905feda4cf65fa9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

libxml2

tucl-1

msvcrt

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 41KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB