246dc5d80ce357bc528c36ce39ef70ac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

246dc5d80ce357bc528c36ce39ef70ac_JaffaCakes118
Size

32KB
MD5

246dc5d80ce357bc528c36ce39ef70ac
SHA1

9f88871551172a5922dc2f1f33aa0ad3d045b874
SHA256

113548690dea81cd7a5fc98d3feddc631f329b8c6e84946f8719638f0cdacebc
SHA512

e41ba92c4424ccaf0dd6ed3c2460bfb999bf2ebbcf9edfa96a129201b91addf0609071c481910cab0821961318ca91f8e88ccabb278faa684c03987ca563006a
SSDEEP

768:xBa9J7yRJwJzRZ7f3nDxgdo28KvIT3PJ+:U6JwJX7fdqYKvH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
246dc5d80ce357bc528c36ce39ef70ac_JaffaCakes118

Files

246dc5d80ce357bc528c36ce39ef70ac_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0ed5834a2d5cddf9cf16708f7252adf3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetQueryOptionA
InternetOpenA
InternetSetOptionA
HttpAddRequestHeadersA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
HttpSendRequestA

dnsapi

DnsFree
DnsQuery_A

shlwapi

StrToIntA
wnsprintfA

ws2_32

inet_ntoa
shutdown
closesocket
WSASocketA
setsockopt
bind
gethostbyname
inet_addr
htons
WSASend
WSARecv
select
WSAGetLastError
connect
ioctlsocket
WSAStartup
WSAIoctl
socket
getsockopt

rpcrt4

UuidCreate

crypt32

CryptStringToBinaryA
CryptDecodeObjectEx

netapi32

NetWkstaGetInfo
NetApiBufferFree

msvcr100

_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
GetTimeZoneInformation
SetUnhandledExceptionFilter
GetTickCount
InterlockedDecrement
GetQueuedCompletionStatus
TlsAlloc
GetSystemInfo
IsDebuggerPresent
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameW
CreateProcessW
ExitProcess
HeapCreate
TlsSetValue
HeapDestroy
GetModuleHandleA
FindResourceA
LoadResource
LockResource
CreateThread
TlsGetValue
SizeofResource
FreeResource
InterlockedExchangeAdd
Sleep
GetSystemTime
lstrcatA
GetLocalTime
SystemTimeToFileTime
GetProcessHeap
HeapAlloc
HeapFree
lstrlenA
InitializeCriticalSection
CreateEventA
PostQueuedCompletionStatus
WaitForSingleObject
CreateIoCompletionPort
ResetEvent
LeaveCriticalSection
SetEvent
EnterCriticalSection
DeleteCriticalSection
CloseHandle
OutputDebugStringA
GetLastError
lstrcpyA

user32

wsprintfW
wsprintfA

advapi32

CryptGetHashParam
CryptCreateHash
CryptHashData
CryptSignHashA
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
CryptImportKey

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ed5834a2d5cddf9cf16708f7252adf3

Headers

DLL Characteristics

File Characteristics

Imports

wininet

dnsapi

shlwapi

ws2_32

rpcrt4

crypt32

netapi32

msvcr100

kernel32

user32

advapi32

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 4B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 4B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 2KB - Virtual size: 1KB