9dac4644bca8c1e645729e1775f3af7b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

9dac4644bca8c1e645729e1775f3af7b_JaffaCakes118
Size

1.5MB
MD5

9dac4644bca8c1e645729e1775f3af7b
SHA1

f70988f607d36c4e6bc885bf70fdb16e9acf94ef
SHA256

c0e61a73129505b65afd347cf6c47aa6452b1067100d919680439700eaefdc48
SHA512

d6fcb14f0f7880a02dfa0363d05ef7d70bb9a7c87c3c6e5ccd5a6b7ffa739330af4f01d6d6b20cb7e9cb4d8c3776c7007e9494c42d752262021e2776bad6eb3b
SSDEEP

24576:f70l+GbIlY8gTS+KXGo9hM5pA3m5MlAstWfR5Vpkr+YF7gQBjni35TYwNNLaXJ:g+UhKWonM7WlAstWlPYqOU5TL+XJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wildrig.exe

Files

9dac4644bca8c1e645729e1775f3af7b_JaffaCakes118
.7z .ps1 polyglot
kernel-baffin.bin
.elf linux
kernel-ellesmere.bin
.elf linux
kernel-fiji.bin
.elf linux
kernel-gfx900.bin
.elf linux
kernel-tonga.bin
.elf linux
start.bat
wildrig.exe
.exe windows:6 windows x64 arch:x64

035a55c11a6d3d1ab55f0f36a5373179

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

connect
WSACleanup
__WSAFDIsSet
accept
send
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
FreeAddrInfoW
GetAddrInfoW
WSASocketW
WSASend
WSARecv
WSAIoctl
socket
shutdown
listen
getsockname
ioctlsocket
bind
setsockopt
getsockopt
closesocket
WSAGetLastError
htonl
htons
gethostname

iphlpapi

GetAdaptersAddresses

opencl

clEnqueueWriteBuffer
clGetPlatformIDs
clGetDeviceIDs
clGetPlatformInfo
clGetDeviceInfo
clCreateContext
clCreateCommandQueueWithProperties
clCreateBuffer
clCreateProgramWithBinary
clBuildProgram
clReleaseKernel
clReleaseProgram
clReleaseMemObject
clReleaseCommandQueue
clReleaseContext
clReleaseDevice
clEnqueueNDRangeKernel
clCreateKernel
clEnqueueReadBuffer
clFinish
clSetKernelArg
clGetProgramBuildInfo

kernel32

GetACP
GetModuleFileNameA
HeapReAlloc
GetTimeZoneInformation
HeapAlloc
GetConsoleCP
SetFileAttributesW
GetFileAttributesExW
SetStdHandle
ExitThread
GetModuleHandleExW
ExitProcess
GetCommandLineW
HeapFree
GetProcessHeap
GetCommandLineA
SystemTimeToTzSpecificLocalTime
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
GetLastError
CreateMutexA
GetStdHandle
GetConsoleMode
SetConsoleMode
Sleep
GetCurrentProcessId
SwitchToThread
CloseHandle
WaitForSingleObject
FreeConsole
GetConsoleWindow
GetCurrentProcess
GetCurrentThread
GetSystemInfo
SetThreadAffinityMask
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
SetEvent
ReleaseSemaphore
CreateEventA
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
CreateSemaphoreW
VerSetConditionMask
GetCurrentDirectoryW
QueryPerformanceCounter
FindClose
GetModuleFileNameW
VerifyVersionInfoA
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
SetErrorMode
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
CreateFileA
CreateFileW
DuplicateHandle
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
WriteConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleCursorInfo
SetConsoleTextAttribute
GetNumberOfConsoleInputEvents
ReadConsoleW
ReadConsoleInputW
WriteConsoleW
SetConsoleCtrlHandler
GetFileType
CreateDirectoryW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFinalPathNameByHandleW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
SetLastError
DeviceIoControl
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
CreateSymbolicLinkW
SetHandleInformation
CancelIo
SetFileCompletionNotificationModes
DebugBreak
LocalFree
FormatMessageA
GetModuleHandleA
GetProcAddress
LoadLibraryA
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
GetNamedPipeHandleStateA
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
GetLongPathNameW
ReadDirectoryChangesW
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetTickCount64
VirtualFree
VirtualAlloc
RaiseException
CreateThread
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapSize
SetEndOfFile
QueryPerformanceFrequency
WriteFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentThreadId
CreateEventW
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetStringTypeW
GetCPInfo
RtlCaptureContext

user32

GetMessageA
TranslateMessage
DispatchMessageA
MapVirtualKeyW
ShowWindow

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

Exports

Exports

argon2_ctx
argon2_ctx_from_mtp
argon2_encodedlen
argon2_error_message
argon2_hash
argon2_type2string
argon2_verify
argon2_verify_ctx
argon2d_ctx
argon2d_hash_encoded
argon2d_hash_raw
argon2d_verify
argon2d_verify_ctx
argon2i_ctx
argon2i_hash_encoded
argon2i_hash_raw
argon2i_verify
argon2i_verify_ctx
argon2id_ctx
argon2id_hash_encoded
argon2id_hash_raw
argon2id_verify
argon2id_verify_ctx

Sections

.text
Size: 581KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 453KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 194KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

035a55c11a6d3d1ab55f0f36a5373179

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

opencl

kernel32

user32

advapi32

winmm

Exports

Exports

Sections

.text Size: 581KB - Virtual size: 580KB

.rdata Size: 453KB - Virtual size: 452KB

.data Size: 194KB - Virtual size: 205KB

.pdata Size: 24KB - Virtual size: 24KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 512B - Virtual size: 360B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 581KB - Virtual size: 580KB

.rdata
Size: 453KB - Virtual size: 452KB

.data
Size: 194KB - Virtual size: 205KB

.pdata
Size: 24KB - Virtual size: 24KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 512B - Virtual size: 360B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 5KB - Virtual size: 4KB