fbcff01f4fed0aee5de01d8c6c2fceb8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fbcff01f4fed0aee5de01d8c6c2fceb8_JaffaCakes118
Size

42KB
MD5

fbcff01f4fed0aee5de01d8c6c2fceb8
SHA1

9a6687c0d2fe82d77ce7837bd9c173f852e1e661
SHA256

bd9bf918f685a04df28543c6c09f34eea1b9b3a1223a25d922878632e61637a8
SHA512

b83f23968c5309650aa13cdb9e8fb8341f62aaee95d5a81a33f44029dd444cc561628906d9fc7c9bb8c68d8baa861a3dc4f4166f5fae4a9efc65664a5b2a1b65
SSDEEP

768:3rgeWGJaj2b2/K6/1CSGIKPlavRzY0nEs3UgLM6KLi0z1xZFop:Ubs4K6dyNPIvRMEEgCnZip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbcff01f4fed0aee5de01d8c6c2fceb8_JaffaCakes118

Files

fbcff01f4fed0aee5de01d8c6c2fceb8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8428bbc7d7a645de0023d5a121be2195

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

setsockopt
sendto
socket
gethostbyname
htons
connect
send
recv
inet_ntoa
WSASocketA
htonl
gethostname
WSAGetLastError
inet_addr
WSAIoctl
select
closesocket
WSACleanup
WSAStartup

msvcrt

_stricmp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
strchr
_beginthreadex
free
realloc
strcmp
_access
strcat
strrchr
strncpy
_iob
fprintf
sprintf
printf
strcpy
time
srand
rand
atoi
_local_unwind2
_except_handler3
_CxxThrowException
memcmp
??2@YAPAXI@Z
strstr
memset
strlen
__CxxFrameHandler
_ftol
ceil
memcpy
??3@YAXPAX@Z
_strupr
_strcmpi
_controlfp

mfc42

ord540
ord800
ord6877
ord939
ord2818
ord4278
ord860
ord6663
ord858
ord535
ord922
ord924
ord926
ord4129
ord2764
ord6648
ord537

kernel32

GetDiskFreeSpaceExA
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
HeapFree
VirtualProtect
GetProcessHeap
HeapAlloc
lstrcmpiA
GetCurrentThreadId
GetFileAttributesA
DefineDosDeviceA
MoveFileExA
ExpandEnvironmentStringsA
CopyFileA
SetFileAttributesA
CreateDirectoryA
DuplicateHandle
GetCurrentProcess
GetFileSize
ReadFile
FindFirstFileA
FindClose
GetLocalTime
GlobalMemoryStatusEx
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
GetModuleFileNameA
GetVersionExA
CreateFileA
WriteFile
ExitProcess
GetCurrentProcessId
ExitThread
CreateThread
GetTickCount
CancelIo
InterlockedExchange
SetEvent
Sleep
OutputDebugStringA
ResetEvent
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
lstrcpyA
WaitForSingleObject
CloseHandle
CreateEventA
VirtualFree
GetDriveTypeA

user32

wsprintfA
GetMessageA
GetInputState
PostThreadMessageA
GetWindow
GetWindowTextA
GetClassNameA
FindWindowA

advapi32

AdjustTokenPrivileges
CloseEventLog
ClearEventLogA
StartServiceCtrlDispatcherA
OpenProcessToken
LookupPrivilegeValueA
ChangeServiceConfig2A
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenEventLogA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteExA

wininet

InternetGetConnectedState
InternetOpenUrlA

shlwapi

PathRemoveFileSpecA

Exports

Exports

Shellex

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8428bbc7d7a645de0023d5a121be2195

Headers

File Characteristics

Imports

ws2_32

msvcrt

mfc42

kernel32

user32

advapi32

shell32

wininet

shlwapi

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 5KB - Virtual size: 8KB

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 5KB - Virtual size: 8KB