28f57308b067836d715aa070d29c3232_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

28f57308b067836d715aa070d29c3232_JaffaCakes118
Size

80KB
MD5

28f57308b067836d715aa070d29c3232
SHA1

6d1642be7427e692777f8fd806e96d5266bea220
SHA256

620ad70506f21c2806396a34025471245ebc2f3786068d9c74c49973e754ffc0
SHA512

3475db4a2838a22ef803a94ab2d386f965efedbdb291f7bd1ed9549eee9330540795b691cb4cbd2442a79280a953632087be00f6ce3d1a816c7fd4a359fefb7a
SSDEEP

768:FnQWfHyWMJhLtHEVjICC+dgQbIbo2T0eG/TbTpW3ocmXeyimCIu9y1l4VK/gw:F69EW02T0eG/TY3ollCI62loH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28f57308b067836d715aa070d29c3232_JaffaCakes118

Files

28f57308b067836d715aa070d29c3232_JaffaCakes118
.dll windows:4 windows x86 arch:x86

825a71ca83b262daba919fe2e201dfae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

inet_addr

wanpacket

WanPacketGetStats
WanPacketSetBpfFilter
WanPacketTestAdapter
WanPacketSetReadTimeout
WanPacketSetMode
WanPacketSetMinToCopy
WanPacketReceivePacket
WanPacketCloseAdapter
WanPacketOpenAdapter
WanPacketGetReadEvent
WanPacketSetBufferSize

kernel32

GetStringTypeA
LCMapStringW
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
ReleaseMutex
WaitForSingleObject
WideCharToMultiByte
CloseHandle
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetStringTypeW
MultiByteToWideChar
GetLastError
CreateEventW
DeviceIoControl
SetLastError
CreateFileW
SetEvent
ReadFile
WriteFile
QueryPerformanceFrequency
QueryPerformanceCounter
GetFullPathNameW
LCMapStringA
FlushFileBuffers
CreateMutexW
GetCommandLineA
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
HeapFree
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetFilePointer
InterlockedDecrement
InterlockedIncrement

user32

wsprintfW

advapi32

OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
CreateServiceW
CloseServiceHandle
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
ControlService

iphlpapi

GetAdaptersInfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetDriverVersion
PacketGetNetInfoEx
PacketGetNetType
PacketGetReadEvent
PacketGetStats
PacketGetStatsEx
PacketGetVersion
PacketInitPacket
PacketIsDumpEnded
PacketLibraryVersion
PacketOpenAdapter
PacketReceivePacket
PacketRequest
PacketSendPacket
PacketSendPackets
PacketSetBpf
PacketSetBuff
PacketSetDumpLimits
PacketSetDumpName
PacketSetHwFilter
PacketSetMinToCopy
PacketSetMode
PacketSetNumWrites
PacketSetReadTimeout
PacketSetSnapLen
PacketStopDriver

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

825a71ca83b262daba919fe2e201dfae

Headers

File Characteristics

Imports

ws2_32

wanpacket

kernel32

user32

advapi32

iphlpapi

version

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 36KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 36KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 8KB - Virtual size: 4KB