220f9372fde5a6625b144e2260e58df4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

220f9372fde5a6625b144e2260e58df4_JaffaCakes118
Size

576KB
MD5

220f9372fde5a6625b144e2260e58df4
SHA1

5974d1a1d60b8ac0ce70a9a63d5a76e09c93351d
SHA256

5f43cb85710b116d204981a84ae928bd78bbcb5c273fee920453ed8e6e521b8c
SHA512

f7cbeb79275da9c3df1e91c0062031bfa3721feb94b6b961c76ad3ca2a9ff0dc4f88a853f8f2a573b98ff6247c5aebb32b4c9bee4d114c151811f721ecbc23b4
SSDEEP

6144:ol8xm+vpx0vl5AwfCDntql/Z1BBfLns60DqkWTjbheESzw1gBTmi:ol88IxKhAtqL1BBfI6AVWTjb0EAwqBT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
220f9372fde5a6625b144e2260e58df4_JaffaCakes118

Files

220f9372fde5a6625b144e2260e58df4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

959974c63a7d62eab60f3e0cf332c36c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\My Documents\Visual Studio Projects\lazybot\Debug\pircbot.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
SleepEx
ReadFile
PeekNamedPipe
ResumeThread
CreatePipe
GetFileAttributesA
GetLastError
FindClose
FindNextFileA
FindFirstFileA
lstrcatA
GetTickCount
CreateDirectoryA
GetDriveTypeA
GetLogicalDriveStringsA
GetPrivateProfileStringA
lstrcpyA
SetCurrentDirectoryA
FreeLibrary
CompareStringW
CompareStringA
SetEndOfFile
GetLocaleInfoW
GetProcessHeap
CreateFileA
WriteFile
GlobalLock
GlobalUnlock
SetErrorMode
CopyFileA
SetFileAttributesA
DeleteFileA
GetStdHandle
AllocConsole
SetConsoleCtrlHandler
CreateProcessA
CreateMutexA
WaitForSingleObject
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetCurrentDirectoryA
GetVersionExA
OpenProcess
TerminateProcess
GetCurrentProcess
CloseHandle
Sleep
CreateToolhelp32Snapshot
Process32First
lstrlenA
Process32Next
GetSystemInfo
VirtualProtect
VirtualQuery
GetUserDefaultLCID
EnumSystemLocalesA
SetEnvironmentVariableA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
GetDateFormatA
GetTimeFormatA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
CreateSemaphoreA
ReleaseSemaphore
ReleaseMutex
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
GetCurrentProcessId
InterlockedCompareExchange
RtlUnwind
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
SetStdHandle
GetFileType
MoveFileA
GetStartupInfoA
GetCommandLineA
FatalAppExitA
GetCPInfo
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
CreateThread
ExitThread
DebugBreak
OutputDebugStringA
SetLastError
SetUnhandledExceptionFilter
HeapFree
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetACP
GetOEMCP
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
FlushFileBuffers
IsBadCodePtr

user32

CloseClipboard
OpenClipboard
wsprintfA
GetClipboardData

gdi32

GetDeviceCaps
CreateCompatibleDC
DeleteDC
CreateDIBSection
SelectObject
BitBlt
GetDIBColorTable
DeleteObject
CreateDCA

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
OpenSCManagerA
EnumServicesStatusA
OpenServiceA
ControlService
CloseServiceHandle
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameA

shell32

ShellExecuteA
ShellExecuteExA
SHGetFolderPathA
SHGetSpecialFolderPathA

wsock32

WSACleanup
gethostbyname
socket
connect
recv
htons
send

Exports

Exports

??0Exception@impl@pircbot@@QAE@ABV012@@Z
??0Exception@impl@pircbot@@QAE@XZ
??0IOException@impl@pircbot@@QAE@ABV012@@Z
??0IOException@impl@pircbot@@QAE@XZ
??0IrcException@impl@pircbot@@QAE@ABV012@@Z
??0IrcException@impl@pircbot@@QAE@XZ
??0NickAlreadyInUseException@impl@pircbot@@QAE@ABV012@@Z
??0NickAlreadyInUseException@impl@pircbot@@QAE@XZ
??1Exception@impl@pircbot@@UAE@XZ
??1IOException@impl@pircbot@@UAE@XZ
??1IrcException@impl@pircbot@@UAE@XZ
??1NickAlreadyInUseException@impl@pircbot@@UAE@XZ
??4Colors@impl@pircbot@@QAEAAV012@ABV012@@Z
??4Exception@impl@pircbot@@QAEAAV012@ABV012@@Z
??4IOException@impl@pircbot@@QAEAAV012@ABV012@@Z
??4IrcException@impl@pircbot@@QAEAAV012@ABV012@@Z
??4NickAlreadyInUseException@impl@pircbot@@QAEAAV012@ABV012@@Z
??_7Exception@impl@pircbot@@6B@
??_7IOException@impl@pircbot@@6B@
??_7IrcException@impl@pircbot@@6B@
??_7NickAlreadyInUseException@impl@pircbot@@6B@
?what@Exception@impl@pircbot@@UBEPBDXZ

Sections

.textbss
Size: - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 484KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

959974c63a7d62eab60f3e0cf332c36c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

wsock32

Exports

Exports

Sections

.textbss Size: - Virtual size: 224KB

.text Size: 484KB - Virtual size: 481KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 12KB - Virtual size: 24KB

.idata Size: 8KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1KB

.textbss
Size: - Virtual size: 224KB

.text
Size: 484KB - Virtual size: 481KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 12KB - Virtual size: 24KB

.idata
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1KB