309145288cb624bbe37fd7718834ace1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

309145288cb624bbe37fd7718834ace1_JaffaCakes118
Size

26KB
MD5

309145288cb624bbe37fd7718834ace1
SHA1

2b919d8c8c75b46fe0729b7d4c81e60da371a9e7
SHA256

566fda00006c08dfa96216dac9ae5af3a29c3b998081af75c67e6959c1a24b7f
SHA512

f3aea33b2ac8dd689d8d5ab1be8fcae039d225d23a74162a2079e7b8354ea353a7216a38aa54b8f3097bea2f2af1a3c30abaf57c70ea3b55c3fb7bcb7701d065
SSDEEP

384:3Z0FEGTzI9b93rHuZoHTF7herK9ds77nOog4ER98zAfnWiSOLJ+ORc9PYP0:3ZlSz2uETdhWGs7SofER98HiSOL1RTP0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
309145288cb624bbe37fd7718834ace1_JaffaCakes118

Files

309145288cb624bbe37fd7718834ace1_JaffaCakes118
.dll windows:4 windows x86 arch:x86

af2c3cd43dddf7547de5bb16e4e64210

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
WaitForSingleObject
ReadFile
SetFilePointer
GetModuleFileNameA
GetTempPathA
GetWindowsDirectoryA
Sleep
SetFileAttributesA
GetCommandLineA
GetSystemDirectoryA
DeleteFileA
CreateFileA
CloseHandle
LoadLibraryA
GetProcAddress
GlobalAlloc
VirtualProtect
CreateMutexA
GetLastError
ExitProcess
IsBadReadPtr

user32

wsprintfA

msvcp60

??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

ws2_32

WSAStartup
send
recv
socket
inet_addr
htons
connect
gethostbyname
inet_ntoa
closesocket
WSACleanup

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

msvcrt

strrchr
_access
strcat
memset
strchr
strncpy
free
__dllonexit
_onexit
_initterm
_adjust_fdiv
_getpid
_stricmp
_strlwr
_strrev
malloc
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
strcmp
strlen
strncmp
strstr
atoi
sprintf
strcpy

netapi32

Netbios

Exports

Exports

COMResModuleInstance
DriverProc
KsCreateAllocator
KsCreatePin
KsCreateTopologyNode
ServerMain
modMessage
modmCallback

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af2c3cd43dddf7547de5bb16e4e64210

Headers

File Characteristics

Imports

kernel32

user32

msvcp60

ws2_32

wininet

msvcrt

netapi32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 542KB

Shared Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 542KB

Shared
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 3KB