02611947594c49a61af03d769f55a66c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

02611947594c49a61af03d769f55a66c_JaffaCakes118
Size

251KB
MD5

02611947594c49a61af03d769f55a66c
SHA1

0b56a4ce4484eefb3494842a11d6ed92d3cc8402
SHA256

abcc9e0b28e5e2fbc09cca6d8897c9fdd136ba8b82f93b688376eef1936e8f81
SHA512

1242cb40335d253664b8da7a3687dc9dd6eb139a92b3fe08a1a155bf547259e3f953c2bb1f8a9b15cbf57d92279ec835cddfe0bd5c8c6d2e04e376bbf665271a
SSDEEP

6144:1JEMA7LCSK41tvfoKM4RLYIvAAZ7Evwd6g83qC:1Cb5daIv83qC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02611947594c49a61af03d769f55a66c_JaffaCakes118

Files

02611947594c49a61af03d769f55a66c_JaffaCakes118
.dll windows:6 windows x86 arch:x86

7515fe48a606f00ce8c60e960952b16d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

adsnt.pdb

Imports

msvcrt

_wcsnicmp
_ftol2
wcsrchr
_CxxThrowException
_XcptFilter
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_except_handler4_common
_unlock
wcsncpy_s
__dllonexit
_lock
_onexit
wcsncat_s
swprintf_s
wcschr
_ltow
_wtol
_itow_s
wcscat_s
_purecall
wcscpy_s
memset
memcpy
_wcsicmp

ntdll

RtlRunEncodeUnicodeString
RtlInitUnicodeString
RtlRunDecodeUnicodeString
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970

activeds

ord17
ord15
ord18
ord23
ord22
ord21
ord16
ord7
ord14

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
CreatePointerMoniker
StringFromGUID2
CLSIDFromString
IIDFromString

advapi32

UnlockServiceDatabase
OpenServiceW
QueryServiceConfigW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
GetSidIdentifierAuthority
GetSidSubAuthorityCount
ChangeServiceConfigW
GetLengthSid
RegConnectRegistryW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
SystemFunction041
LockServiceDatabase
QueryServiceStatus
StartServiceW
ControlService
LookupAccountNameW
EnumServicesStatusW
SystemFunction040
DeleteService
GetUserNameW
GetSidSubAuthority

winspool.drv

AddPrinterW
SetPrinterW
OpenPrinterW
EnumJobsW
SetJobW
ClosePrinter
GetPrinterW
EnumPrintersW
DeletePrinter
GetJobW

kernel32

InterlockedIncrement
GetLastError
SetLastError
SystemTimeToFileTime
GetSystemTime
CompareStringW
GetTickCount
FreeLibrary
DeleteCriticalSection
InterlockedDecrement
LocalFree
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
lstrlenW
InitializeCriticalSection
DisableThreadLibraryCalls
GetComputerNameW
SystemTimeToTzSpecificLocalTime
LoadLibraryW
GetSystemDirectoryW
GetProcAddress
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FormatMessageW
FileTimeToDosDateTime
DosDateTimeToFileTime
RaiseException
GetModuleHandleW

oleaut32

VariantCopy
VariantTimeToDosDateTime
DosDateTimeToVariantTime
VariantInit
VariantClear
DispGetIDsOfNames
LoadRegTypeLi
DispInvoke
SetErrorInfo
VariantTimeToSystemTime
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
CreateErrorInfo
SystemTimeToVariantTime

netapi32

NetUserDel
I_NetNameCompare
NetFileEnum
NetFileGetInfo
NetShareEnum
NetShareAdd
NetShareGetInfo
NetShareDel
NetShareSetInfo
NetLocalGroupAdd
NetGroupGetUsers
NetGroupEnum
NetLocalGroupEnum
NetGetDCName
NetGetAnyDCName
NetWkstaGetInfo
NetUseGetInfo
NetWkstaUserGetInfo
NetLocalGroupGetMembers
NetSessionDel
NetGroupDel
NetSessionEnum
NetSessionGetInfo
NetServerSetInfo
NetLocalGroupGetInfo
NetGroupAdd
NetGroupDelUser
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupDelMembers
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
NetUserGetLocalGroups
NetUserGetGroups
NetGroupGetInfo
NetUserChangePassword
NetUserAdd
NetServerGetInfo
NetLocalGroupSetInfo
NetGroupSetInfo
NetUserGetInfo
NetUserSetInfo
NetQueryDisplayInformation
NetUserModalsGet
NetUserModalsSet
NetApiBufferFree
NetServerEnum
NetLocalGroupDel

mpr

WNetCancelConnection2W
WNetAddConnection2W

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7515fe48a606f00ce8c60e960952b16d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

activeds

ole32

advapi32

winspool.drv

kernel32

oleaut32

netapi32

mpr

Exports

Exports

Sections

.text Size: 207KB - Virtual size: 206KB

.data Size: 31KB - Virtual size: 30KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 207KB - Virtual size: 206KB

.data
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB