4a0aa231c1a4b5f2d4efec0dc0768d3c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4a0aa231c1a4b5f2d4efec0dc0768d3c_JaffaCakes118
Size

44KB
MD5

4a0aa231c1a4b5f2d4efec0dc0768d3c
SHA1

31cbca7efd4d6387fbc8925d8880c9cd3ce46710
SHA256

52d5129f6aa68b88ca3950c3055964c736c2b1d4ac28e5971b503d827c22747f
SHA512

55feac8e1bb67580d3516b03dd8ea33b7e23d543e774156d7390392196a9b8e04b8b45ee70e4ef883a4892dfe053a2ae58bf2df340130bea9e5865308f84852d
SSDEEP

768:dLiMzbFwJZMbJ6lsTkxqHTdGEbwjpzXB0a6EG:8A0sgtz90aF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a0aa231c1a4b5f2d4efec0dc0768d3c_JaffaCakes118

Files

4a0aa231c1a4b5f2d4efec0dc0768d3c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7bda9a083fc5f74bd3f6254a47edac41

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

psapi

EnumProcessModules
GetModuleFileNameExA

ws2_32

closesocket
listen
accept
send
select
setsockopt
inet_addr
htons
bind
socket
WSAIoctl
recv
gethostname
gethostbyname
inet_ntoa
WSACleanup
WSAStartup
connect

advapi32

StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
ChangeServiceConfigA
QueryServiceConfigA
CloseServiceHandle
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

kernel32

Sleep
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
ReadFile
Module32First
WriteFile
DisconnectNamedPipe
WaitForMultipleObjects
TerminateThread
GetDiskFreeSpaceExA
GetDriveTypeA
WaitForSingleObject
GetSystemDefaultLangID
GetTickCount
GlobalMemoryStatus
PeekNamedPipe
CreateThread
GetSystemTime
GetTempPathA
CloseHandle
GetLastError
GetCurrentProcess
HeapFree
HeapAlloc
GetProcessHeap
ExitThread
Module32Next
WinExec
GetEnvironmentVariableW
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess

user32

ExitWindowsEx

gdi32

GetDeviceCaps
CreateDCA
DeleteDC

urlmon

URLDownloadToFileA

netapi32

NetApiBufferFree
NetUserEnum

msvcrt

fclose
fprintf
fopen
printf
_except_handler3
sprintf
strncat
strchr
free
malloc
atoi
strstr
_strupr
strncpy
_strnicmp
_wcsicmp
_stricmp

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7bda9a083fc5f74bd3f6254a47edac41

Headers

File Characteristics

Imports

psapi

ws2_32

advapi32

kernel32

user32

gdi32

urlmon

netapi32

msvcrt

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 22KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 22KB

.reloc
Size: 4KB - Virtual size: 2KB