4341d40f962178914e5a8771ba1960d5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4341d40f962178914e5a8771ba1960d5_JaffaCakes118
Size

164KB
MD5

4341d40f962178914e5a8771ba1960d5
SHA1

75400fa8d478c09d683ef771c44f31f1f2c3c5dd
SHA256

96476b1c2500f65ea408b1e59aba497332c598eb734cf05efa6073c3f136b26c
SHA512

825848315ed0eb230370a0807749a33329288b411029ea25f13fb432752149a49d5fc002e47aaf0d6d6128ac9aaff77710f17c8b354d645efa4bc330ddda6b3f
SSDEEP

3072:GgzwLz7ePNEGl0K4bwdKjSUAHcOG5ylPy0itpyPa:ELz7ePB48Tbs4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4341d40f962178914e5a8771ba1960d5_JaffaCakes118

Files

4341d40f962178914e5a8771ba1960d5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

ce577dc5af1869bbced4e3781f309102

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

inet_ntoa
htons
WSAGetLastError
gethostbyname
send
sendto
__WSAFDIsSet
select
gethostname
closesocket
inet_addr
WSAStartup
WSACleanup
connect
socket
recv
recvfrom
ntohs

python24

PyString_AsStringAndSize
PyObject_CallFunction
PyObject_GetAttrString
PyImport_ExecCodeModule
Py_IsInitialized
PyRun_SimpleString
Py_Initialize
Py_Finalize
PyMarshal_ReadObjectFromString

kernel32

WriteConsoleW
CompareStringW
CompareStringA
SetEndOfFile
ReadFile
GetStringTypeW
GetStringTypeA
SetStdHandle
SetFilePointer
GetConsoleOutputCP
WriteConsoleA
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
GetLocaleInfoA
VirtualQuery
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
CreateThread
CloseHandle
WaitForSingleObject
GetLocalTime
GetVersion
SetUnhandledExceptionFilter
Sleep
DeviceIoControl
CreateFileA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetCurrentProcessId
GetTickCount
GetCommandLineA
GetCurrentThreadId
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExA
GetProcAddress
LoadLibraryA
FreeEnvironmentStringsA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetTimeZoneInformation
HeapSize
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
SetHandleCount
DeleteCriticalSection
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetEnvironmentVariableA
GetFileType
GetStdHandle
GetModuleFileNameW
RtlUnwind
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
ExitProcess
LoadLibraryW
WideCharToMultiByte

user32

GetMessageExtraInfo
keybd_event
CallNextHookEx
GetKeyboardState
GetAsyncKeyState
UnhookWindowsHookEx
ToAscii
PostMessageA
SetWindowsHookExA

netapi32

Netbios

winmm

timeGetTime

iphlpapi

GetAdaptersInfo

Exports

Exports

?DecryptAccountInfo@@YGHPADH0H@Z
?DecryptGuid@@YGHPBDHPADHPAK2@Z
?EncryptGuid@@YGHPBDHKKPADH@Z
CalcKey
DiffieEncrypt
GetIdentify
GetKeySeed
GetRobotDigestsFromStream
GetTroyDigestsFromStream
GetValidate
ProtectInit
ProtectStart
ProtectStop
StopLibrary
TextDecode
ValidateProcessModulesInDll

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce577dc5af1869bbced4e3781f309102

Headers

File Characteristics

Imports

ws2_32

python24

kernel32

user32

netapi32

winmm

iphlpapi

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 114KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 116KB - Virtual size: 114KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 12KB - Virtual size: 8KB