6596dbcdb777eb6314e9f03929e259cc_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6596dbcdb777eb6314e9f03929e259cc_JaffaCakes118
Size

1.3MB
MD5

6596dbcdb777eb6314e9f03929e259cc
SHA1

c1a09c9a30e82c294065be61559dec20185e312d
SHA256

6db4ab8fe4f521287706150279088347d0293fece5aaed18ab6bb5c587b549b9
SHA512

0528be21cdb6699e9777a82d851f412572d820637d971336e6a51c5c48cd45f90671ccebf5feb7e7f3a11cf20f598ed123015b51bb0c76101c0d45ccbf0e65fb
SSDEEP

24576:VVBaUaDhbjTwvISwDTI+MwwsfJ9Ugs28r47dWd4t9:+dbtSwLMwwo7dcu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
6596dbcdb777eb6314e9f03929e259cc_JaffaCakes118

Files

6596dbcdb777eb6314e9f03929e259cc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

be997fb676695123a36b44bb0c4f88aa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl-4

curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_global_cleanup
curl_global_init
curl_slist_append
curl_slist_free_all
curl_version_info

libjansson-4

json_array_get
json_array_size
json_deep_copy
json_delete
json_dumps
json_integer
json_integer_value
json_load_file
json_loadb
json_loads
json_number_value
json_object
json_object_get
json_object_set_new
json_real
json_real_value
json_string
json_string_value

kernel32

CloseHandle
ContinueDebugEvent
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetConsoleScreenBufferInfo
GetCurrentProcess
GetEnvironmentVariableA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
PurgeComm
QueryDosDeviceA
SetCommConfig
SetCommTimeouts
SetConsoleCursorPosition
SetEnvironmentVariableA
SetPriorityClass
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForDebugEvent
WideCharToMultiByte

msvcrt

_access
_close
_execv
_fdopen
_isatty
_read
_stat
_strdup
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_errno
_iob
_isctype
_onexit
_open_osfhandle
_pctype
_setmode
_strnicmp
abort
atexit
atof
atoi
calloc
ceil
difftime
div
exit
fclose
fflush
floor
fopen
fputc
fread
free
fseek
ftell
fwrite
getc
getenv
isalpha
isspace
ldiv
localeconv
localtime
log10
malloc
mbstowcs
memcmp
memcpy
memmove
memset
perror
raise
realloc
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtod
strtok
strtol
time
tolower
toupper
vfprintf
wcslen
wcstombs

pthreadgc2

pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_create
pthread_detach
pthread_join
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_self
pthread_setcancelstate
pthread_setcanceltype
ptw32_pop_cleanup
ptw32_push_cleanup

libusb-1.0

libusb_bulk_transfer@24
libusb_claim_interface@8
libusb_close@4
libusb_control_transfer@32
libusb_detach_kernel_driver@8
libusb_error_name@4
libusb_exit@4
libusb_free_config_descriptor@4
libusb_free_device_list@8
libusb_get_bus_number@4
libusb_get_config_descriptor@12
libusb_get_device_address@4
libusb_get_device_descriptor@8
libusb_get_device_list@8
libusb_get_string_descriptor_ascii@16
libusb_init@4
libusb_open@8
libusb_ref_device@4
libusb_release_interface@8
libusb_reset_device@4
libusb_set_configuration@8
libusb_unref_device@4

ws2_32

WSAGetLastError
WSAIoctl
accept
bind
closesocket
htonl
htons
inet_addr
inet_ntoa
listen
recv
select
send
setsockopt
shutdown
socket

pdcurses

LINES
cbreak
delwin
echo
endwin
erase
getmaxx
getmaxy
halfdelay
idlok
immedok
initscr
keypad
leaveok
mvwhline
mvwin
mvwprintw
newwin
nocbreak
noecho
scrollok
stdscr
touchwin
vw_printw
wattroff
wattron
wclear
wclrtoeol
wgetch
wgetnstr
wmove
wprintw
wrefresh
wresize

libblkmaker-0.1-0

blkmk_address_to_script
blkmk_append_coinbase_safe
blkmk_get_data
blkmk_init_generation
blkmk_sha256_impl
blkmk_time_left
blkmk_work_left
blktmpl_addcaps
blktmpl_create
blktmpl_free
blktmpl_get_longpoll
strcasecmp

libblkmaker_jansson-0.1-0

blkmk_submit_jansson
blktmpl_add_jansson
blktmpl_request_jansson

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 490KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be997fb676695123a36b44bb0c4f88aa

Headers

File Characteristics

Imports

libcurl-4

libjansson-4

kernel32

msvcrt

pthreadgc2

libusb-1.0

ws2_32

pdcurses

libblkmaker-0.1-0

libblkmaker_jansson-0.1-0

Sections

.text Size: 387KB - Virtual size: 387KB

.data Size: 7KB - Virtual size: 7KB

.rdata Size: 63KB - Virtual size: 62KB

.bss Size: - Virtual size: 21KB

.idata Size: 8KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

/4 Size: 1KB - Virtual size: 1KB

/19 Size: 490KB - Virtual size: 490KB

/31 Size: 22KB - Virtual size: 22KB

/45 Size: 57KB - Virtual size: 57KB

/57 Size: 50KB - Virtual size: 49KB

/70 Size: 11KB - Virtual size: 11KB

/81 Size: 84KB - Virtual size: 83KB

/92 Size: 512B - Virtual size: 304B

.text
Size: 387KB - Virtual size: 387KB

.data
Size: 7KB - Virtual size: 7KB

.rdata
Size: 63KB - Virtual size: 62KB

.bss
Size: - Virtual size: 21KB

.idata
Size: 8KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

/4
Size: 1KB - Virtual size: 1KB

/19
Size: 490KB - Virtual size: 490KB

/31
Size: 22KB - Virtual size: 22KB

/45
Size: 57KB - Virtual size: 57KB

/57
Size: 50KB - Virtual size: 49KB

/70
Size: 11KB - Virtual size: 11KB

/81
Size: 84KB - Virtual size: 83KB

/92
Size: 512B - Virtual size: 304B