f7463a5cbf81401c53ba32b88cdf4426_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f7463a5cbf81401c53ba32b88cdf4426_JaffaCakes118
Size

88KB
MD5

f7463a5cbf81401c53ba32b88cdf4426
SHA1

e6d2e7ef65a98fbb44047c82437b8d5cc2a5bcd6
SHA256

0ff41df9f6065a341232f54c2a7dbd14939baec81afa48e89fb46712844320a2
SHA512

94597860a38077956f7ee95a5221fe920a70879a46534b154fe5e3f59cb2428c6ff8d13f0338fb0a34680e6b750320055b9ee05f7941b5346059fa8bf4eada45
SSDEEP

1536:kDv6DAmn4pylXPwZzuw2i+jUhwJQ+3Wcrd1iX4ZavIn+m0kNX9O:6On4K4ZqieBPPioZavIn+m02O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7463a5cbf81401c53ba32b88cdf4426_JaffaCakes118

Files

f7463a5cbf81401c53ba32b88cdf4426_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d5d5681c02e23661093d9657cb37bf7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Crash\projects\bot\Release\mbot.pdb

Imports

kernel32

Sleep
lstrcpyA
lstrlenA
lstrcmpA
WriteFile
CreateThread
lstrcatA
TerminateThread
GetCurrentThreadId
ExitThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapSize
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
InitializeCriticalSection
IsBadCodePtr
IsBadReadPtr
SetFilePointer
IsBadWritePtr
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
ExitProcess
RtlUnwind
RaiseException
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetSystemTimeAsFileTime
TlsSetValue
GetCommandLineA
GetVersionExA
TlsFree
SetLastError
TlsGetValue
GetLastError
TlsAlloc
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
HeapAlloc
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
WideCharToMultiByte
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
GetStringTypeA
MultiByteToWideChar
CloseHandle

user32

MessageBoxA
GetMessageA
PeekMessageA
PostThreadMessageA

winmm

timeGetTime

ws2_32

connect
closesocket
socket
__WSAFDIsSet
recv
setsockopt
htons
WSAGetLastError
gethostbyname
WSAStartup
WSACleanup
shutdown
send
select

Exports

Exports

threadFunc

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5d5681c02e23661093d9657cb37bf7b

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 52KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 8KB - Virtual size: 12KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 52KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 8KB - Virtual size: 12KB

.reloc
Size: 8KB - Virtual size: 4KB