f36aabdb7ca38bdca618d1b08af23dfa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f36aabdb7ca38bdca618d1b08af23dfa_JaffaCakes118
Size

365KB
MD5

f36aabdb7ca38bdca618d1b08af23dfa
SHA1

ce0791fe38b2c87b47a6b784763f63c8ebf6c472
SHA256

32348a684b1c4ee8da66a7aa805e009e606f5debf99339f94c4b9e252dbfd238
SHA512

dfa99f4f341382c8f2651beed48865a26bc7ecd64ea0b77ccff715e9379cac3107f2657ccc5c8f8e2801d4c115aef13dfcc0f8eadc7eeddc7cfcbb2334f49808
SSDEEP

6144:JvXgQ0aTdS8CENhDSGh32L6YCRSzFEFURiKheXg2iB8kU6avoe/UPgvtVDukqE:FXgQ0sdSgDS0GW89neXg2M8ie/UITDuV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f36aabdb7ca38bdca618d1b08af23dfa_JaffaCakes118

Files

f36aabdb7ca38bdca618d1b08af23dfa_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ee1fbadfd08b5f5eb87ffe3a93bac70a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

expsrv

rtcImmediateIf
__vbaUdtVar
GetMem4
__vbaVarImp
_adj_fdivr_m64
__vbaMidStmtVar
rtcVarFromFormatVar
__vbaVar2Vec
rtcTrimBstr
__vbaExitProc
rtcCompareBstr
rtcFV
rtcIRR
__vbaCyForNext
__vbaStrComp
__vbaDateStr
__vbaVargVarMove
rtcChoose
rtcSwitch
__vbaForEachVar
__vbaDerefAry1
rtcGetCurrentCalendar
__vbaRecAnsiToUni
SetMemEvent
__vbaUbound
rtcMidCharVar
rtcStringBstr
__vbaRsetFixstr
__vbaOnError
rtcGetMinuteOfHour
rtUI1FromErrVar
__vbaRecDestructAnsi
EbResetProjectNormal
__vbaR8ForNextCheck
__vbaStrCat
__vbaVarFix
__vbaR8IntI2
rtcMacId
__vbaStr2Vec
__vbaVarTextTstLe
__vbaFpI2
rtcSetDateBstr
__vbaEnd
__vbaVarSub
__vbaVargObjAddref
__vbaAryLock
__vbaVarTextCmpLt
__vbaVarTextLikeVar
__vbaEraseKeepData
__vbaR4ForNextCheck
__vbaEraseNoPop
__vbaCVarAryUdt
__vbaNextEachCollVar
__vbaVarTstGt
rtcMakeDir
rtR8FromErrVar
__vbaVarVargNofree
rtcCVErrFromVar
__vbaGenerateBoundsError
__vbaFreeStrList
__vbaGet3
__vbaVarMul
__vbaI2Str
rtcPartition
rtcAnsiValueBstr
__vbaFpCmpCy
__vbaVarTextCmpEq
rtcCommandVar
__vbaVarTstLe
__vbaGosubReturn
__vbaFpI4
rtcVarDateFromVar
rtcStrReverse
rtcChangeDrive
__vbaR4ErrVar

kernel32

AddLocalAlternateComputerNameW
ClearCommBreak
GetVolumeInformationW
GlobalLock
LeaveCriticalSection
GetPrivateProfileSectionNamesA
SetThreadLocale
CopyFileExW
SetTermsrvAppInstallMode
SetSystemTimeAdjustment
GlobalReAlloc
VirtualAlloc
InterlockedPushEntrySList
EnumTimeFormatsA
GetStringTypeExW
EnterCriticalSection
SetUserGeoID
SetDefaultCommConfigW
SetCurrentDirectoryA
GetConsoleInputExeNameA
AddRefActCtx
GetConsoleInputExeNameW
LoadLibraryA
ReleaseMutex
GlobalAddAtomW
GetSystemDirectoryA
GetFileSize
lstrcmpiA
GetPrivateProfileSectionA
RemoveLocalAlternateComputerNameW
DeleteVolumeMountPointW
GetModuleFileNameA
BaseCheckAppcompatCache
GetConsoleHardwareState
BuildCommDCBW
DeleteCriticalSection
HeapDestroy
GetFileSizeEx
FlushInstructionCache
InterlockedIncrement
RequestDeviceWakeup
SetCalendarInfoA
SetCommMask

wsock32

WEP
getpeername
GetAddressByNameW
getservbyport
MigrateWinsockConfiguration
send
WSARecvEx
socket
getservbyname
rexec
EnumProtocolsA
GetNameByTypeW
WSAStartup
WSAAsyncGetServByName
accept
connect
GetTypeByNameW
__WSAFDIsSet
getnetbyname
WSAAsyncGetProtoByNumber
getprotobynumber
gethostbyname
WSAGetLastError
WSACleanup
htons
WSAAsyncGetServByPort
WSASetBlockingHook
gethostbyaddr
s_perror
bind
WSApSetPostRoutine
AcceptEx
WSAUnhookBlockingHook
rresvport
GetTypeByNameA
WSASetLastError
inet_ntoa
SetServiceW
select
NPLoadNameSpaces
listen
htonl

opengl32

glPixelStoref
glClear
glRectd
glPopClientAttrib
glVertex2fv
glLineStipple
glGetMapfv
glEdgeFlag
glEvalCoord2fv
glGetTexParameterfv
glTexEnvf
glColor4us
glDebugEntry
glIndexs
glGetTexEnviv
glMap2f
glDrawArrays
glMap1d
glCullFace
glNormalPointer
glTexGenf
glGetTexGenfv
glRasterPos2f
glPopAttrib
glListBase
wglSetPixelFormat
glColor4usv
glEvalPoint2
glNormal3f
glDepthFunc
glTexCoord2sv
glNormal3sv
glLighti

udhisapi

GetExtensionVersion
HttpExtensionProc
TerminateExtension

mshtmled

DllUnregisterServer
DllRegisterServer
DllGetClassObject
DllEnumClassObjects

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee1fbadfd08b5f5eb87ffe3a93bac70a

Headers

DLL Characteristics

File Characteristics

Imports

expsrv

kernel32

wsock32

opengl32

udhisapi

mshtmled

Sections

.text Size: 177KB - Virtual size: 177KB

.rdata Size: 122KB - Virtual size: 121KB

.data Size: 58KB - Virtual size: 514KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 1008B

.text
Size: 177KB - Virtual size: 177KB

.rdata
Size: 122KB - Virtual size: 121KB

.data
Size: 58KB - Virtual size: 514KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 1008B