043f9c5071903238f84896107bdf4be8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

043f9c5071903238f84896107bdf4be8_JaffaCakes118
Size

98KB
MD5

043f9c5071903238f84896107bdf4be8
SHA1

14865a5a271b0f43404fde653d95ccd4a46bd291
SHA256

b80b208a28e60e8e6aa67971cc101af12eadfd77e621f92de4ff97b0909243f6
SHA512

1a4eb4afbfb161bb507286f260b568fd7a36501f8992ad8a68fbc81ed585612479130e8df453b289dbd662d18b7055aef47f59ca9d3383f7f7d79c7983c8cbdb
SSDEEP

1536:VPNaOeBD4Y5VmtSicKHOQWTfCxqDZKcQmynQ9kFGVQ1zme+LTFyb:ZNavD5mtSic5KYtVNyQ9GGQzlkTFq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
043f9c5071903238f84896107bdf4be8_JaffaCakes118

Files

043f9c5071903238f84896107bdf4be8_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ceee11e482f10fe076bdb03226c7103e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

6to4svc.pdb

Imports

msvcrt

swprintf
malloc
memcpy
wcslen
strlen
_adjust_fdiv
memcmp
memset
wcscpy
_wcsicmp
wcscmp
wcsncpy
_initterm
free
memmove
wcschr
_except_handler3
wcscat

ntdll

RtlInitUnicodeString
RtlGUIDFromString
RtlStringFromGUID

kernel32

FreeLibrary
QueryPerformanceCounter
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
HeapAlloc
HeapFree
CreateTimerQueue
InterlockedIncrement
InterlockedDecrement
RegisterWaitForSingleObject
CreateEventW
CloseHandle
UnregisterWait
DeleteTimerQueueTimer
DeleteTimerQueue
CreateTimerQueueTimer
ChangeTimerQueueTimer
ReleaseMutex
WaitForSingleObject
UnregisterWaitEx
Sleep
GetComputerNameExW
HeapReAlloc
CreateFileW
DeviceIoControl
GetTickCount
HeapDestroy
CreateMutexW
HeapCreate
DisableThreadLibraryCalls
BindIoCompletionCallback
ReadFile
WriteFile
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
DeleteCriticalSection
QueueUserWorkItem
SetEvent
SetLastError
GetProcAddress

wmi

WmiNotificationRegistrationW

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo
NotifyAddrChange
NotifyRouteChange

ws2_32

WSALookupServiceEnd
ntohl
WSALookupServiceBeginW
WSAEventSelect
WSASendTo
htonl
htons
WSALookupServiceNextW
WSARecvFrom
shutdown
setsockopt
listen
WSAAddressToStringA
bind
WSAGetLastError
WSAAddressToStringW
getaddrinfo
socket
closesocket
WSAStringToAddressA
freeaddrinfo
WSAStartup
WSASocketW
WSAIoctl
inet_ntoa
ntohs
getsockname
getnameinfo

rtutils

TracePrintfExW
TraceDeregisterW
RouterLogRegisterW
TraceRegisterExW
RouterLogDeregisterW

advapi32

CryptAcquireContextW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegQueryValueExW
CryptReleaseContext
CryptGenRandom

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree

dnsapi

DnsReplaceRecordSetW

mswsock

GetAcceptExSockaddrs
AcceptEx

Exports

Exports

ServiceMain

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ceee11e482f10fe076bdb03226c7103e

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

wmi

iphlpapi

ws2_32

rtutils

advapi32

ole32

dnsapi

mswsock

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 2KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 2KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB