0eea3bbddfdb2746f62f39aa5a2067d5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0eea3bbddfdb2746f62f39aa5a2067d5_JaffaCakes118
Size

460KB
MD5

0eea3bbddfdb2746f62f39aa5a2067d5
SHA1

61197982c502a1a1750dc83f7686eec123ed1cc0
SHA256

4ddce9fc2b32b488cb34c1541a59840121e753ad0cb72dd0e96c51e4f4753816
SHA512

db76defe829b4a1327ee50bbeb97ed9e767364080851e1d6b00dfbede2b90427fb1226b8d7170cb4543c9231a8326d47ce21874ddff31441b33fbe958900483c
SSDEEP

6144:VtxMLBlS38s6xoCxg/v7zskiKT6PsoMj+Y2gkhxl6YH2X7kVUK7zhrppWXrRJY:Vgdc35Ec37wPD+KBhHXVUKhppWXli

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eea3bbddfdb2746f62f39aa5a2067d5_JaffaCakes118

Files

0eea3bbddfdb2746f62f39aa5a2067d5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4518d87d24faeb16670a4a21d23d7f0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

tchatcli

ord1
ord2

tsmproc

ord8
ord9
ord1
ord5
ord15
ord17
ord16
ord14
ord6
ord12
ord7
ord2
ord4
ord3
ord10

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

ws2_32

recv
closesocket
shutdown
setsockopt
htons
gethostbyname
listen
__WSAFDIsSet
send
connect
inet_ntoa
ioctlsocket
select
htonl
bind
accept
getsockname
WSAGetLastError
WSAStartup
WSACleanup
inet_addr
socket
WSASetLastError

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

mfc42

ord3127
ord3616
ord3663
ord798
ord1997
ord4278
ord5465
ord5194
ord350
ord533
ord715
ord415
ord4129
ord5605
ord1081
ord3810
ord5710
ord5683
ord3584
ord543
ord803
ord3758
ord3408
ord3227
ord3054
ord3425
ord3880
ord919
ord5651
ord934
ord3402
ord3698
ord765
ord2370
ord6334
ord2379
ord6215
ord6199
ord2642
ord6197
ord6379
ord4299
ord6453
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1134
ord2725
ord1146
ord1168
ord2645
ord2863
ord2086
ord2814
ord1200
ord4277
ord939
ord6662
ord3228
ord3409
ord3759
ord2864
ord1871
ord4220
ord2584
ord3654
ord2438
ord1644
ord5572
ord2919
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord384
ord686
ord6007
ord3286
ord2862
ord2097
ord535
ord6888
ord4160
ord3092
ord6905
ord6675
ord3301
ord4853
ord4710
ord4234
ord2302
ord693
ord324
ord641
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord4376
ord5265
ord3640
ord3370
ord4402
ord2582
ord834
ord920
ord837
ord537
ord6877
ord2614
ord6282
ord6283
ord858
ord6222
ord2764
ord941
ord2763
ord823
ord860
ord4202
ord6663
ord2385
ord1233
ord2152
ord4275
ord818
ord567
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord5241
ord4407
ord1776
ord4078
ord6055
ord540
ord2818
ord800
ord825
ord5933
ord1576

msvcrt

??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
calloc
fputc
fclose
fread
fwrite
_errno
fopen
ftell
_ltoa
srand
rand
strtok
_mbschr
_purecall
_mbsstr
time
__p___argv
__p___argc
_mbsicmp
_fdopen
_mbslen
_strcmpi
malloc
isdigit
atol
free
realloc
strstr
_access
rename
remove
_stricmp
_ftol
_mbscmp
atoi
printf
__CxxFrameHandler
_strlwr
_itoa
wcslen
_setmbcp
_controlfp

kernel32

MultiByteToWideChar
GetStartupInfoA
SetLastError
GetSystemTime
FileTimeToSystemTime
WritePrivateProfileStringA
LoadLibraryA
GetProcAddress
GetVersion
CreateFileA
GetFileSize
ReadFile
WriteFile
DeleteFileA
CreateProcessA
GetSystemDirectoryA
CopyFileA
Sleep
GetVersionExA
WaitForSingleObject
OpenProcess
CreateThread
GetLastError
CloseHandle
FreeLibrary
OutputDebugStringA
GetModuleFileNameA
GetPrivateProfileStringA
lstrcpyA
GetPrivateProfileIntA
SetFileAttributesA
MoveFileA
FindClose
FindFirstFileA
CreateDirectoryA
RemoveDirectoryA
SetFilePointer
FindNextFileA
lstrlenA
GetFileTime
WinExec
CreateEventA
GetWindowsDirectoryA
TerminateProcess
lstrcatA
lstrcmpiA
WideCharToMultiByte
LocalFree
FormatMessageA
GetCurrentProcess
GetExitCodeProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetDriveTypeA
GetLogicalDrives
GetModuleHandleA
GlobalFree
GlobalAlloc
InterlockedDecrement
SetLocalTime
lstrcpynA
GetTickCount
InterlockedIncrement
SetFileTime
WaitForMultipleObjects
SetEvent
ResetEvent
ResumeThread
CreateMutexA
OpenMutexA
ReleaseMutex
CreateSemaphoreA
OpenSemaphoreA
ReleaseSemaphore
GetCurrentThreadId
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
GetLocalTime

user32

ExitWindowsEx
MoveWindow
SetForegroundWindow
LoadStringA
SetActiveWindow
GetActiveWindow
ShowWindow
MessageBoxA
IsWindow
GetMenuItemID
TrackPopupMenu
GetCursorPos
LoadIconA
GetSubMenu
LoadMenuA
GetSystemMenu
InsertMenuA
GetMenuStringA
EnableMenuItem
GetSysColor
DestroyWindow
DefWindowProcA
RegisterWindowMessageA
wsprintfA
KillTimer
SetTimer
CloseWindow
PostMessageA
GetWindowRect
AppendMenuA
DeleteMenu
GetForegroundWindow
RegisterClassA
CreateWindowExA
GetTopWindow
GetWindowThreadProcessId
GetClientRect
FindWindowA
SendMessageA
EnableWindow
SetMenuDefaultItem

advapi32

RegCloseKey
CloseServiceHandle
QueryServiceStatus
RegQueryValueExA
StartServiceA
OpenServiceA
OpenSCManagerA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueA
InitiateSystemShutdownA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
ControlService
DeleteService
RegCreateKeyA
CreateServiceA
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
ImpersonateLoggedOnUser
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA

shell32

ShellExecuteA
Shell_NotifyIconA

comctl32

ImageList_SetBkColor

ole32

CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid

oleaut32

SysStringLen
SysFreeString
VariantClear
SysAllocString

Sections

.text
Size: 308KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4518d87d24faeb16670a4a21d23d7f0e

Headers

File Characteristics

Imports

tchatcli

tsmproc

rpcrt4

ws2_32

version

mfc42

msvcrt

kernel32

user32

advapi32

shell32

comctl32

ole32

oleaut32

Sections

.text Size: 308KB - Virtual size: 304KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 28KB - Virtual size: 28KB

.rsrc Size: 84KB - Virtual size: 80KB

.text
Size: 308KB - Virtual size: 304KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 84KB - Virtual size: 80KB