26c3311bb8efdd78474850515595e1cc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

26c3311bb8efdd78474850515595e1cc_JaffaCakes118
Size

415KB
MD5

26c3311bb8efdd78474850515595e1cc
SHA1

d6a184bc3baec4af429725a23dda81ada8bf457b
SHA256

710fd3edd064e99aee4870ff680ef38fee400b13be854a14a264f35a1d51b240
SHA512

a4a84fe8487c4489affb50770c0bdae21d17f221e8519ba9d78b21c1b9099877cda0f2328fe4ec9be281e6ff2265d0cf21bd4ab0e876748ddf79d469b0f7c436
SSDEEP

12288:ph+v+JQ1s5HqPbX/pUl+MVT++Fkyiu9Hg:p0GJAsgPzM9JkGF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26c3311bb8efdd78474850515595e1cc_JaffaCakes118

Files

26c3311bb8efdd78474850515595e1cc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

91e2342012e4b866b98c63c966ca2049

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

LdrGetDllHandle
NtAllocateVirtualMemory
RtlLargeIntegerShiftLeft

kernel32

GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter

msvcrt

malloc
_adjust_fdiv
free
_initterm
_except_handler3

rpcrt4

CStdStubBuffer_Invoke
NdrInterfacePointerBufferSize
NdrInterfacePointerMarshall
NdrPointerUnmarshall
NdrConformantArrayBufferSize
IUnknown_AddRef_Proxy
NdrUserMarshalFree
NdrInterfacePointerFree
CStdStubBuffer_AddRef
NdrClearOutParameters
NdrPointerBufferSize
NdrUserMarshalUnmarshall
NdrConformantArrayMarshall
NdrConformantStringBufferSize
NdrStubForwardingFunction
NdrProxyInitialize
NdrAllocate
NdrConvert
NdrPointerMarshall
NdrDllCanUnloadNow
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
NdrSimpleStructBufferSize
NdrOleAllocate
NdrUserMarshalMarshall
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer_Release
NdrStubGetBuffer
NdrDllUnregisterProxy
RpcRaiseException
CStdStubBuffer_IsIIDSupported
NdrProxyErrorHandler
NdrInterfacePointerUnmarshall
NdrPointerFree
NdrConformantArrayUnmarshall
NdrProxySendReceive
NdrConformantStringMarshall
NdrStubInitialize
NdrStubCall2
NdrDllGetClassObject
NdrSimpleStructUnmarshall
NdrSimpleTypeUnmarshall
NdrDllRegisterProxy
NdrUserMarshalBufferSize
CStdStubBuffer_CountRefs
NdrSimpleStructMarshall
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrConformantStringUnmarshall
NdrCStdStubBuffer2_Release
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerQueryInterface
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrSimpleTypeMarshall
IUnknown_Release_Proxy

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 333KB - Virtual size: 928KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91e2342012e4b866b98c63c966ca2049

Headers

File Characteristics

Imports

ntdll

kernel32

msvcrt

rpcrt4

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 333KB - Virtual size: 928KB

.rdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 333KB - Virtual size: 928KB

.rdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 512B - Virtual size: 20B