8637f5f239545f04b02d2220d6b2cc1a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8637f5f239545f04b02d2220d6b2cc1a_JaffaCakes118
Size

60KB
MD5

8637f5f239545f04b02d2220d6b2cc1a
SHA1

6ea10e7d3efd1d6660703135360740536b0dea29
SHA256

b84aa088196aec1b65ceb988fb79e7a2cec2884c6095d77ea5b749cf870cfb3a
SHA512

2982c88a0ff71c4b15fc27a4b8ff0b32386007f28d546f40d025599dda9676c0819143efaaa271267f15c1d9a61e220771c3ddf3d008bf8601606de167c3e673
SSDEEP

1536:neHj0Rp131ZgpL4U+MIbaetDEJA0SaQ6OnCh:eHYb1ZKpesADaQ6OCh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/irftp.exe

Files

8637f5f239545f04b02d2220d6b2cc1a_JaffaCakes118
.cab
irftp.exe
.exe windows:5 windows x86 arch:x86

0b03528cbce7df35256122b2a9aca6b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

irftp.pdb

Imports

mfc42u

ord2634
ord3693
ord765
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord561
ord815
ord2717
ord1165
ord2613
ord5208
ord1131
ord4224
ord941
ord926
ord2637
ord4279
ord3172
ord942
ord3297
ord2606
ord3087
ord5061
ord4629
ord4601
ord4710
ord4744
ord4602
ord5010
ord4369
ord4846
ord3610
ord355
ord4828
ord600
ord1240
ord1173
ord1571
ord269
ord826
ord6466
ord324
ord4370
ord3634
ord4395
ord2573
ord4214
ord2016
ord2405
ord6362
ord1764
ord861
ord2810
ord940
ord6195
ord2294
ord538
ord4155
ord602
ord3562
ord3569
ord4390
ord2567
ord567
ord3716
ord4418
ord3397
ord5286
ord5237
ord1768
ord6051
ord795
ord609
ord2385
ord692
ord5977
ord6375
ord6193
ord6211
ord326
ord641
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord4401
ord1767
ord4073
ord6048
ord2506
ord4704
ord4992
ord4847
ord5261
ord2078
ord2371
ord2859
ord2507
ord4229
ord537
ord925
ord922
ord1569
ord858
ord823
ord825
ord800
ord296
ord540
ord617
ord3658
ord3067
ord5214

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__dllonexit
exit
_cexit
_XcptFilter
__set_app_type
_c_exit
_ftol
wcsncmp
_vsnwprintf
_onexit
_controlfp
wcslen
_except_handler3
__CxxFrameHandler
_exit
??1type_info@@UAE@XZ
wcsncpy
wcsftime
localtime
time
_itow
memmove
atoi
strrchr
_wcmdln
wcsrchr
?terminate@@YAXXZ

advapi32

ReportEventW
RegisterEventSourceW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DeregisterEventSource
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA
RegSetValueW

kernel32

InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
HeapDestroy
GetProcAddress
LoadLibraryA
SetEvent
DeleteCriticalSection
FreeLibrary
LoadLibraryW
CreateEventW
HeapFree
GetProcessHeap
CancelIo
CancelWaitableTimer
MultiByteToWideChar
SetWaitableTimer
CreateWaitableTimerW
HeapAlloc
Beep
UnregisterWait
GetFullPathNameW
RegisterWaitForSingleObject
ReadFile
GetDriveTypeW
GetFileSize
GetStartupInfoW
GetModuleHandleA
LocalAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemInfo
InterlockedExchange
DeleteFileW
GetFileAttributesW
CreateMutexW
GetModuleHandleW
CreateThread
WaitForSingleObject
GetLastError
FormatMessageW
LocalFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetSystemDirectoryW
CreateProcessW
CloseHandle
Sleep
InterlockedIncrement
OutputDebugStringA
InterlockedDecrement
lstrcmpW
lstrlenW
HeapCreate
GetQueuedCompletionStatus
GetSystemWindowsDirectoryW
CopyFileW
GetFileTime
CreateFileW
CreateDirectoryW
GetTempFileNameW
GetTempPathW
MoveFileW
SetFileTime
WriteFile
FindClose
FindNextFileW
FindFirstFileW
SetThreadExecutionState
WideCharToMultiByte
GetDiskFreeSpaceExW
OpenMutexW
UnmapViewOfFile
lstrcmpA
MapViewOfFile
OpenFileMappingW
SystemTimeToFileTime
FileTimeToSystemTime
GetWindowsDirectoryA
QueryPerformanceCounter
PostQueuedCompletionStatus
CreateIoCompletionPort

user32

FindWindowW
GetParent
LoadStringW
MapWindowPoints
GetWindowRect
WinHelpW
SendMessageW
GetDesktopWindow
GetClientRect
IsWindow
FlashWindowEx
EnableWindow
GetForegroundWindow
SetForegroundWindow
MessageBoxW
SetTimer
PostMessageW
DestroyMenu
wsprintfW
TrackPopupMenuEx
SetMenuDefaultItem
GetSubMenu
LoadMenuW
GetCursorPos
DefWindowProcW
SetWindowLongW
GetWindowLongW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW
RegisterClassW
DestroyWindow
CreateWindowExW
ShowWindow
KillTimer
UpdateWindow
SetActiveWindow
LoadImageW

ole32

CoInitialize
CoCreateInstance

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetFolderPathW

shlwapi

PathMakeSystemFolderW
PathCompactPathExW

wtsapi32

WTSRegisterSessionNotification

mswsock

AcceptEx

ntdll

RtlInitUnicodeString
NtCreateFile
NtDeviceIoControlFile
DbgPrint

ws2_32

connect
WSAGetLastError
send
select
recv
accept
socket
closesocket
getsockopt
WSAStartup
listen
setsockopt
WSASocketW
bind

winmm

PlaySoundW
waveOutGetNumDevs

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b03528cbce7df35256122b2a9aca6b5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

advapi32

kernel32

user32

ole32

shell32

shlwapi

wtsapi32

mswsock

ntdll

ws2_32

winmm

Sections

.text Size: 85KB - Virtual size: 85KB

.data Size: 2KB - Virtual size: 29KB

.rsrc Size: 60KB - Virtual size: 60KB

.text
Size: 85KB - Virtual size: 85KB

.data
Size: 2KB - Virtual size: 29KB

.rsrc
Size: 60KB - Virtual size: 60KB