43ab9da86e8848348690db9400b6a516_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

43ab9da86e8848348690db9400b6a516_JaffaCakes118
Size

594KB
MD5

43ab9da86e8848348690db9400b6a516
SHA1

f72794843eb34bb3bdb4b672917e6874019aae89
SHA256

b91a1bac5f1d0288d461570fe7ea3ef81604f2d666168134296442c7f7d73403
SHA512

2e8740aa36efb093ffe396e7c1145ccfa40e638dc07d7fb9c81f8dade17a8ab975a29edc17e67ee7d160a38ff9f79ec88b8b3e52e123738440837cd96a6733cc
SSDEEP

12288:5/uXUQgLXerhMmCtT0H5akYkhZPcRYDC870eQ4Tck2T/:5/uXjZa5kz4YDC/eQ4TcnT/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43ab9da86e8848348690db9400b6a516_JaffaCakes118

Files

43ab9da86e8848348690db9400b6a516_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5dc9c5f56e1a9e803692e311ad28ccdb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore

kernel32

CloseHandle
CreateEventA
CreateFileA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSizeEx
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExA
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SuspendThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

_read
_strdup
_unlink
_write
__argv
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_fmode
_ftime64
_initterm
_iob
_lock
_onexit
_setjmp3
_stati64
_stricmp
_strnicmp
_sys_nerr
_unlock
_vsnprintf
_winmajor
abort
atoi
calloc
exit
fclose
feof
fflush
fgetc
fgets
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
getenv
gmtime
islower
isspace
isupper
isxdigit
localeconv
localtime
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
puts
qsort
raise
realloc
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
time
tolower
vfprintf
wcslen
wcstombs

user32

MessageBoxA

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
socket

Sections

.text
Size: 494KB - Virtual size: 493KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5dc9c5f56e1a9e803692e311ad28ccdb

Headers

File Characteristics

Imports

advapi32

crypt32

kernel32

msvcrt

user32

ws2_32

Sections

.text Size: 494KB - Virtual size: 493KB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 61KB - Virtual size: 60KB

.bss Size: - Virtual size: 5KB

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 60B

.tls Size: 512B - Virtual size: 32B

.text
Size: 494KB - Virtual size: 493KB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 61KB - Virtual size: 60KB

.bss
Size: - Virtual size: 5KB

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 60B

.tls
Size: 512B - Virtual size: 32B