40addc46c07b7eee4811a50fb2aa2e3a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

40addc46c07b7eee4811a50fb2aa2e3a_JaffaCakes118
Size

26KB
MD5

40addc46c07b7eee4811a50fb2aa2e3a
SHA1

883adb09f55e110a4f4d880ff94cbc62a5a48efa
SHA256

08bba12ce7e017a87a0d96e8279d01050318f4cb61573fad3e818f9d8385bedb
SHA512

6df5b35fa16675211eb7798760b953367ad999fc7833c04076a95c2b47c1e9fe1c9a839b7b7e4e0c9ece6bd08f83a5858036959ce7c86e8def4eb49e3b6e2a68
SSDEEP

384:3t0FEGTzI9b93rHuZoHTF7herK9ds77nOog4ER98zAfnWiSOLJ+ORc9P1LR:3tlSz2uETdhWGs7SofER98HiSOL1R+LR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40addc46c07b7eee4811a50fb2aa2e3a_JaffaCakes118

Files

40addc46c07b7eee4811a50fb2aa2e3a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

af2c3cd43dddf7547de5bb16e4e64210

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
WaitForSingleObject
ReadFile
SetFilePointer
GetModuleFileNameA
GetTempPathA
GetWindowsDirectoryA
Sleep
SetFileAttributesA
GetCommandLineA
GetSystemDirectoryA
DeleteFileA
CreateFileA
CloseHandle
LoadLibraryA
GetProcAddress
GlobalAlloc
VirtualProtect
CreateMutexA
GetLastError
ExitProcess
IsBadReadPtr

user32

wsprintfA

msvcp60

??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

ws2_32

WSAStartup
send
recv
socket
inet_addr
htons
connect
gethostbyname
inet_ntoa
closesocket
WSACleanup

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

msvcrt

strrchr
_access
strcat
memset
strchr
strncpy
free
__dllonexit
_onexit
_initterm
_adjust_fdiv
_getpid
_stricmp
_strlwr
_strrev
malloc
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
strcmp
strlen
strncmp
strstr
atoi
sprintf
strcpy

netapi32

Netbios

Exports

Exports

COMResModuleInstance
DriverProc
KsCreateAllocator
KsCreatePin
KsCreateTopologyNode
ServerMain
modMessage
modmCallback

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af2c3cd43dddf7547de5bb16e4e64210

Headers

File Characteristics

Imports

kernel32

user32

msvcp60

ws2_32

wininet

msvcrt

netapi32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 542KB

Shared Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 542KB

Shared
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 3KB