xmrig | 40ad92a7db259d130496cddc5beb1b98_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

40ad92a7db259d130496cddc5beb1b98_JaffaCakes118
Size

739KB
MD5

40ad92a7db259d130496cddc5beb1b98
SHA1

15f22a39d0d987dab7499f8cc65ca41348bcba83
SHA256

9bdbef0326f514dbc4177932fd0c757ee43449017acf2cb8b2c4fface6eea89c
SHA512

b58273d70397d21081bab85eda098769aee784520cd63e1a5956209a27c4c3751d2d9d17035b070506d3dfcd1a8528519b73c5580c37455805f558ada8e6824d
SSDEEP

12288:dy3WV9cw9e3lHtxdgncVXJttn6XTwWN46WuquQFBZynnDazuQwfLRKwl0q4ME:MWVSVNfgnMZtluq/FBkn2zuQULRKg0V

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40ad92a7db259d130496cddc5beb1b98_JaffaCakes118

Files

40ad92a7db259d130496cddc5beb1b98_JaffaCakes118
.exe windows:6 windows x64 arch:x64

a53e3464468825618b8bff10f18d657d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSASetLastError
WSAStartup
select
WSARecvFrom
htonl
bind
WSAIoctl
WSASend
shutdown
WSASocketW
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
closesocket
getsockopt
setsockopt
WSAGetLastError
htons

kernel32

GetEnvironmentStringsW
SetEnvironmentVariableA
GetOEMCP
IsValidCodePage
GetProcessHeap
GetCPInfo
FreeEnvironmentStringsW
FindNextFileA
GetSystemTimes
Sleep
GetStdHandle
SetConsoleMode
GetConsoleMode
CreateMutexW
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
CloseHandle
FreeConsole
GetConsoleWindow
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
LocalAlloc
LocalFree
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
PostQueuedCompletionStatus
SetErrorMode
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
MultiByteToWideChar
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileAttributesW
GetFileInformationByHandle
MoveFileExW
CopyFileW
CreateSymbolicLinkW
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
GetFileType
SleepConditionVariableCS
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
GetModuleFileNameW
QueryPerformanceFrequency
GetSystemInfo
GetCurrentProcessId
QueryPerformanceCounter
FormatMessageA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
GetModuleHandleA
LoadLibraryA
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
FindFirstFileExA
FindClose
HeapSize
GetTimeZoneInformation
GetThreadTimes
DecodePointer
SetFilePointerEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
EncodePointer
RaiseException
FreeLibrary
LoadLibraryExW
RtlUnwindEx
GetCommandLineA
GetCommandLineW
SetStdHandle
GetConsoleCP
GetFileAttributesExW
SetFileAttributesW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetACP
HeapAlloc
HeapFree
HeapReAlloc
GetStringTypeW
CompareStringW

user32

DispatchMessageA
TranslateMessage
ShowWindow
MapVirtualKeyW
GetMessageA

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation

Sections

.text
Size: 567KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a53e3464468825618b8bff10f18d657d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

Sections

.text Size: 567KB - Virtual size: 566KB

.rdata Size: 123KB - Virtual size: 123KB

.data Size: 6KB - Virtual size: 15KB

.pdata Size: 21KB - Virtual size: 21KB

.gfids Size: 512B - Virtual size: 336B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 567KB - Virtual size: 566KB

.rdata
Size: 123KB - Virtual size: 123KB

.data
Size: 6KB - Virtual size: 15KB

.pdata
Size: 21KB - Virtual size: 21KB

.gfids
Size: 512B - Virtual size: 336B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 3KB - Virtual size: 2KB