9a8afe938fd72310f6f68f9a56f38c8b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9a8afe938fd72310f6f68f9a56f38c8b_JaffaCakes118
Size

183KB
MD5

9a8afe938fd72310f6f68f9a56f38c8b
SHA1

d643ff4a487ec9fabe45df1f1c4170b1c5ef9daa
SHA256

caecf7651a56f7ea7bda390f614ccff9064e2ffc4d9adbebdfcb01bb7b6fc0a0
SHA512

3ab27463e56d1d27db33dd4b7a262415e8f8e3aa34a16e7c14fdf93bb482d3d989c32b2c19302e00b7b4c32cbc140f86975cc3f297d43b6ded24629267ccd1e7
SSDEEP

1536:8Kp3Gm4qo8m7V2PB+tw0JwM+51V0JbClqp+f2C35OIRo2oEoK0KLJ+YoRhdPgBDu:8WrypwM+5D4+Yw2C3QrNPgBCDFVphXZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a8afe938fd72310f6f68f9a56f38c8b_JaffaCakes118

Files

9a8afe938fd72310f6f68f9a56f38c8b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

335ae45a4b1bc1aaf634d5d89b3e0c25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetTimer
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA

kernel32

WideCharToMultiByte
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetLogicalDriveStringsA
Sleep
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
GetUserDefaultLCID
GetOEMCP
CreateFileA
GetFileSize
ReadFile
CreateDirectoryA
GetCommandLineA
GetModuleHandleA
FreeLibrary
LoadLibraryA
LCMapStringA
CloseHandle
GetProcAddress
GetNativeSystemInfo
ReleaseMutex
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA

advapi32

LookupAccountNameA
RegQueryValueExA
RegOpenKeyA
ConvertSidToStringSidW
IsValidSid
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize

ws2_32

getpeername
getsockname
accept
listen
bind
htons
ntohs
inet_addr
WSACleanup
recv
send
connect
socket
WSAStartup
inet_ntoa
closesocket

shlwapi

PathFileExistsA

dnsapi

DnsQuery_A

shell32

SHGetSpecialFolderPathA

msvcrt

_strnicmp
malloc
free
memmove
modf
__CxxFrameHandler
strrchr
strncpy
tolower
_ftol
atoi
_CIfmod
strncmp
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf

oleaut32

RegisterTypeLi
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SafeArrayCreate
SafeArrayDestroy
VariantClear
SysAllocString
LHashValOfNameSys

Sections

.text
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

335ae45a4b1bc1aaf634d5d89b3e0c25

Headers

File Characteristics

Imports

user32

kernel32

advapi32

ole32

ws2_32

shlwapi

dnsapi

shell32

msvcrt

oleaut32

Sections

.text Size: 133KB - Virtual size: 132KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 46KB - Virtual size: 107KB

.text
Size: 133KB - Virtual size: 132KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 46KB - Virtual size: 107KB