311988d94d826184db531ba035fac96b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

311988d94d826184db531ba035fac96b_JaffaCakes118
Size

157KB
MD5

311988d94d826184db531ba035fac96b
SHA1

38b77e3f8f3cc39bc4db2e786629c6898328b99e
SHA256

c84642219b2ecd15528c7b6dbc24abf4cd2cfe0ec5f0c0a6ca87fc454662a61e
SHA512

28e1db5619c8c76ec589864014fa003c0673238d3bd4e925f294fadf9d491bd1e25cb45ed9e3bf2118262a176f381bf6793335bf573dba9d5e848013106d92ab
SSDEEP

3072:lfq2avquOUUH1OGF/pstBaDqwONnct437Bl3N2UH:1ahOP1OGF/p/uwONct43j92U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
311988d94d826184db531ba035fac96b_JaffaCakes118

Files

311988d94d826184db531ba035fac96b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fb871ad613ca840f5c3a4403acc3e174

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Log\9_30\ms11_046_cover\Debug\ms11_046_cover.pdb

Imports

mfc100ud

ord4884
ord16667
ord4897
ord5369
ord5336
ord5332
ord5366
ord5387
ord5345
ord5374
ord5383
ord5353
ord5357
ord5361
ord5349
ord5378
ord5341
ord1777
ord1770
ord1772
ord1766
ord1759
ord13221
ord13223
ord15144
ord3440
ord10175
ord11924
ord7719
ord2744
ord4886
ord13122
ord9904
ord15963
ord12863
ord4037
ord2873
ord10077
ord16660
ord16659
ord16732
ord16750
ord16746
ord16748
ord16749
ord16747
ord2965
ord9045
ord3477
ord3480
ord14996
ord6879
ord3339
ord3340
ord3589
ord3590
ord12309
ord11938
ord9973
ord13078
ord4270
ord14776
ord11351
ord11961
ord1340
ord4419
ord5625
ord14191
ord7551
ord862
ord9052
ord292
ord1003
ord13071
ord4142
ord3241
ord3552
ord3439
ord13117
ord6368
ord11153
ord10149
ord4555
ord2599
ord7232
ord417
ord2273
ord9300
ord8218
ord1064
ord1029
ord1062
ord8762
ord2250
ord1441
ord934
ord15191
ord4290
ord1451
ord1428
ord1449
ord9358
ord9264
ord13931
ord16444
ord5851
ord2561
ord13532
ord13533
ord15964
ord8691
ord15970
ord10338
ord4347
ord4288
ord14016
ord8712
ord2080
ord16763
ord12908
ord15841
ord13525
ord8765
ord16157
ord16154
ord16159
ord16156
ord16158
ord16155
ord4053
ord6535
ord13198
ord13206
ord4993
ord9053
ord11324
ord13216
ord13167
ord13997
ord5692
ord6079
ord6340
ord10291
ord6049
ord6343
ord5695
ord5914
ord5672
ord8467
ord8468
ord8458
ord5912
ord15965
ord8692
ord15971
ord7563
ord12638
ord14929
ord3553
ord6560
ord9057
ord11148
ord10148
ord4670
ord2695
ord14235
ord7542
ord991
ord11270
ord8374
ord13035
ord1442
ord2480
ord2204
ord2300

msvcr100d

_fmode
_commode
__setusermatherr
_configthreadlocale
??_V@YAXPAX@Z
strstr
__CxxFrameHandler3
memset
malloc
free
memcpy
system
printf
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_CRT_RTC_INITW
_initterm_e
_initterm
_CrtDbgReportW
_CrtSetCheckCount
_wcmdln
exit
_cexit
_XcptFilter
_exit
__wgetmainargs
_amsg_exit

kernel32

GetProcAddress
GetModuleHandleW
DeviceIoControl
VirtualAlloc
LoadLibraryExA
GetCurrentProcess
InterlockedExchange
Sleep
MulDiv
InterlockedCompareExchange
HeapSetInformation
EncodePointer
GetVersionExW
GetStartupInfoW
DecodePointer
FreeLibrary
VirtualQuery
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
UnhandledExceptionFilter
TerminateProcess
LoadLibraryW
lstrlenA
RaiseException
MultiByteToWideChar
IsDebuggerPresent
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetLastError

user32

GetSystemMetrics
CopyRect
IsRectEmpty
PtInRect
SetRect
SetRectEmpty
EqualRect
InflateRect
OffsetRect
IntersectRect
SubtractRect
UnionRect

comctl32

InitCommonControlsEx

oleaut32

SysFreeString

ws2_32

WSASocketA
WSAGetLastError
inet_addr
htons
connect
WSACleanup
WSAStartup

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb871ad613ca840f5c3a4403acc3e174

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc100ud

msvcr100d

kernel32

user32

comctl32

oleaut32

ws2_32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 82KB - Virtual size: 82KB

.reloc Size: 3KB - Virtual size: 3KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 82KB - Virtual size: 82KB

.reloc
Size: 3KB - Virtual size: 3KB