016c06e79f288f1f0fac1446bc06c3a6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

016c06e79f288f1f0fac1446bc06c3a6_JaffaCakes118
Size

32KB
MD5

016c06e79f288f1f0fac1446bc06c3a6
SHA1

2641668722d0327544af7c5fd8b22f9042f65469
SHA256

b2ea021b994eafcba07e36e3ba83bd7830a93d1a1aa1e9e2e639343acfc6a155
SHA512

217db83792235413ef73be39b18da0e31b1c9a22d795e03ff61dd091202810676818bbed9023ede3b5c8aafe929ad0e0622236c06968324fe7fffcef56d0970f
SSDEEP

768:99tm6rGAx5wbvczYrY2R4/XdZ4ftUnX+3Arr5Q:9m+zx5wjciS/Xv4ftGXqAr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
016c06e79f288f1f0fac1446bc06c3a6_JaffaCakes118

Files

016c06e79f288f1f0fac1446bc06c3a6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

a155b93e135c1c69d68096d58b612f91

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlFormatCurrentUserKeyPath
ZwCreateKey
ZwSetValueKey
RtlTimeToSecondsSince1970
ZwQueryKey
RtlNtStatusToDosError
RtlHashUnicodeString
ZwGetContextThread
ZwWriteVirtualMemory
ZwTestAlert
ZwResumeThread
ZwQuerySystemInformation
ZwProtectVirtualMemory
strcmp
RtlImageDirectoryEntryToData
_stricmp
LdrGetDllHandle
NtWriteFile
ZwSetInformationFile
_wcsicmp
ZwQueryDirectoryFile
RtlEqualUnicodeString
RtlEqualString
LdrGetProcedureAddress
ZwSetEvent
RtlImageNtHeader
memmove
ZwWaitForSingleObject
ZwReplyWaitReceivePortEx
ZwCreatePort
ZwQueryInformationProcess
RtlGetCurrentPeb
ZwRequestWaitReplyPort
memset
strtoul
memcmp
LdrFindEntryForAddress
memcpy
strchr
ZwReadFile
ZwOpenFile
RtlFreeUnicodeString
wcslen
strstr
RtlComputeCrc32
strlen
RtlInitUnicodeString
swprintf
ZwQueryValueKey
ZwOpenKey
wcscmp
RtlGetFrame
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
wcsrchr
RtlInsertElementGenericTableAvl
RtlUnwind
_alldiv
sprintf
RtlStringFromGUID
ZwWriteFile
ZwDeleteFile
ZwRequestPort
ZwClose
ZwQueryInformationFile
ZwCreateFile
ZwSetContextThread
RtlPushFrame
NtQueryVirtualMemory

kernel32

GetModuleHandleW
VirtualFree
VirtualAlloc
MultiByteToWideChar
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitThread
CreateRemoteThread
GetLastError
BindIoCompletionCallback
WideCharToMultiByte
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
DisableThreadLibraryCalls
GetTickCount
VirtualProtect
LoadLibraryExW

ws2_32

WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSACleanup
WSAStartup
shutdown
gethostbyname

ole32

CLSIDFromProgID
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
LoadTypeLibEx
SysAllocStringLen
SysFreeString
VariantClear

rpcrt4

UuidCreateSequential

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a155b93e135c1c69d68096d58b612f91

Headers

File Characteristics

Imports

ntdll

kernel32

ws2_32

ole32

oleaut32

rpcrt4

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 1KB