08e81b6ebf1ee918a66a11078dd150e6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

08e81b6ebf1ee918a66a11078dd150e6_JaffaCakes118
Size

3.4MB
MD5

08e81b6ebf1ee918a66a11078dd150e6
SHA1

48d7411de7652698062ce0ec40bcf6871fb1d076
SHA256

e7231e5ff5273a53e101a6f25dc447a88312177a111d8357d90ad690a89d5439
SHA512

9b5357ed68715e352a96c3c89c65d95d0ee838519d60331862d344028f08c0393fd107fe1654b6509f1fe9a39e5b7440ac48af9b4d6fc046aa9b2218a3a8679a
SSDEEP

24576:wtee6x742Lf7iNaki2XmJgIQVFqfJ5vZxINMyEESbgiPMLRKhyRB2Y+ycrNeau:wlI727WJgIQVsf2MyEEJiQvB83

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08e81b6ebf1ee918a66a11078dd150e6_JaffaCakes118

Files

08e81b6ebf1ee918a66a11078dd150e6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9db691855c57cc5b8310ee436efc51c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ddraw

DirectDrawCreate

winmm

joyGetNumDevs
mmioAscend
mmioRead
joyGetPosEx
joySetThreshold
joySetCapture
joyGetDevCapsA
timeGetTime
mmioOpenA
mmioDescend
mmioClose

dsound

ord1

wsock32

inet_addr
gethostbyname
socket
htons
WSAAsyncSelect
bind
listen
ioctlsocket
gethostbyaddr
connect
inet_ntoa
accept
send
recv
WSACleanup
sendto
closesocket
WSAStartup
gethostname

kernel32

InterlockedExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
OutputDebugStringA
lstrlenA
GetModuleHandleA
CloseHandle
MultiByteToWideChar
CreateFileA
Sleep
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
GetLastError
WriteFile
CreateThread
InitializeCriticalSection
InterlockedCompareExchange

user32

TranslateMessage
LoadImageA
MessageBoxA
DestroyWindow
UpdateWindow
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
GetSystemMetrics
GetKeyState
PostMessageA
PostQuitMessage
DefWindowProcA
SetCursor
ClientToScreen
GetClientRect
PeekMessageA
GetMessageA
ShowWindow
DispatchMessageA
InvalidateRect
SetRect

gdi32

DeleteObject
SelectObject
GetObjectA
StretchBlt
DeleteDC
SetBkColor
CreateCompatibleDC
SetTextColor
TextOutA

comdlg32

GetOpenFileNameA

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance

msvcr80

srand
_controlfp_s
_invoke_watson
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
sscanf
_except_handler4_common
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
??_U@YAPAXI@Z
sprintf
__CxxFrameHandler3
free
fprintf
fclose
fscanf
feof
fopen
malloc
rand
fgets
_chdir
_getcwd
_localtime64
_time64
calloc

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

msvcp80

?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ

Sections

0
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

2
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

3
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

4
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

5
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9db691855c57cc5b8310ee436efc51c3

Headers

File Characteristics

Imports

ddraw

winmm

dsound

wsock32

kernel32

user32

gdi32

comdlg32

shell32

ole32

msvcr80

wininet

msvcp80

Sections

0 Size: 280KB - Virtual size: 280KB

1 Size: 24KB - Virtual size: 24KB

2 Size: 52KB - Virtual size: 52KB

3 Size: 3.0MB - Virtual size: 3.0MB

4 Size: 72KB - Virtual size: 72KB

5 Size: 4KB - Virtual size: 4KB

6 Size: 32KB - Virtual size: 32KB

.aspack Size: 8KB - Virtual size: 8KB

.adata Size: 4KB - Virtual size: 4KB

0
Size: 280KB - Virtual size: 280KB

1
Size: 24KB - Virtual size: 24KB

2
Size: 52KB - Virtual size: 52KB

3
Size: 3.0MB - Virtual size: 3.0MB

4
Size: 72KB - Virtual size: 72KB

5
Size: 4KB - Virtual size: 4KB

6
Size: 32KB - Virtual size: 32KB

.aspack
Size: 8KB - Virtual size: 8KB

.adata
Size: 4KB - Virtual size: 4KB