5a3d6aec7b891376d7b8fc9d1269215b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5a3d6aec7b891376d7b8fc9d1269215b_JaffaCakes118
Size

336KB
MD5

5a3d6aec7b891376d7b8fc9d1269215b
SHA1

5b47945c51d8aafd26a945fd4b902c817abf6968
SHA256

caf70da3786ac7ebdfb2cec54b0c2f381be149164de278ba9b22e23d49da2816
SHA512

768f9f61d75989959992cab96a9eded1f0319f91e4bb1366d437729a1b9d04d0e3553d22b267e924a0158a68f1c47700bd48e86c9ab575e874dbf5ac9c5ccf35
SSDEEP

6144:ZLauwkMDxypTDgmi8+9TvyCuo4+HnXonAO/P007O0c+2x:ZxMDxy+mgT34nA+7O8U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a3d6aec7b891376d7b8fc9d1269215b_JaffaCakes118

Files

5a3d6aec7b891376d7b8fc9d1269215b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e223d04858d1ce947dc8112026335113

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
WSACancelAsyncRequest
WSAAsyncGetHostByName
getsockname
accept
recv
WSAAsyncSelect
socket
WSAGetLastError
gethostname
bind
connect
WSAStartup
WSACleanup
closesocket
send
recvfrom
htonl
ntohs
inet_addr
listen
inet_ntoa
setsockopt
sendto
shutdown
htons

mfc42

ord2770
ord5600
ord1083
ord5607
ord772
ord500
ord998
ord3663
ord5450
ord6394
ord2841
ord5440
ord6383
ord2107
ord5621
ord5860
ord6142
ord5608
ord3811
ord548
ord5642
ord537
ord559
ord812
ord6144
ord5862
ord3616
ord3127
ord389
ord6426
ord5204
ord1074
ord5808
ord5356
ord5353
ord690
ord922
ord3181
ord4058
ord3178
ord3010
ord3304
ord6663
ord926
ord887
ord880
ord6874
ord5186
ord6648
ord6385
ord1979
ord532
ord1105
ord356
ord4168
ord785
ord518
ord2781
ord3319
ord3310
ord6673
ord1980
ord353
ord6407
ord798
ord2393
ord4277
ord6282
ord5861
ord1601
ord521
ord6307
ord803
ord543
ord3584
ord403
ord3318
ord404
ord273
ord603
ord703
ord882
ord2801
ord879
ord2740
ord665
ord354
ord1575
ord5683
ord3337
ord940
ord5442
ord668
ord6400
ord5460
ord6571
ord1871
ord4083
ord4033
ord434
ord535
ord800
ord939
ord924
ord860
ord540
ord825
ord823
ord6143
ord941
ord2818
ord801
ord541
ord6883
ord5572
ord2915
ord2763
ord859
ord2764
ord5710
ord4278
ord858
ord4129
ord6662
ord2614
ord501
ord6877
ord5651
ord3130
ord3676
ord5575
ord839
ord433
ord466
ord2141
ord350
ord465
ord464
ord773

msvcrt

wcstombs
_mbsicmp
strncpy
__CxxFrameHandler
strlen
memset
memcpy
strchr
atoi
rand
printf
strcat
strncat
strcpy
strcmp
_purecall
_snprintf
sprintf
wcslen
wcscmp
fclose
fwrite
fopen
wcscpy
fgetc
fread
fseek
_mbscmp
_controlfp
_strlwr
_strnicmp
isalnum
_vsnprintf
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
strstr
fgets
sscanf
free
realloc
memmove
malloc
rename
?terminate@@YAXXZ
fprintf
_iob
strncmp
getenv
_stricmp
srand
time
_except_handler3
_CxxThrowException
swprintf
__dllonexit
_onexit
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_wcsicmp

kernel32

GetSystemTime
GetCurrentThreadId
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentProcessId
SetPriorityClass
GetVolumeInformationA
GetProcessTimes
GetExitCodeThread
WaitForMultipleObjects
WideCharToMultiByte
lstrcmpiA
WinExec
SetFileAttributesA
GetDriveTypeA
GetLogicalDriveStringsA
RemoveDirectoryA
CreateProcessA
CreatePipe
GetExitCodeProcess
GlobalReAlloc
LoadLibraryExA
SetFilePointer
CreateDirectoryA
GetWindowsDirectoryA
FileTimeToSystemTime
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalMemoryStatus
GlobalSize
CopyFileA
GetTempFileNameA
GetShortPathNameA
ExitProcess
GetTempPathA
GetCommandLineA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateIoCompletionPort
GetQueuedCompletionStatus
GetOverlappedResult
OutputDebugStringA
FindFirstFileA
GetFileSize
FindNextFileA
FindClose
SetThreadPriority
ResumeThread
SuspendThread
TerminateThread
GetCurrentDirectoryA
ResetEvent
MultiByteToWideChar
WaitForSingleObject
CreateEventA
SetEvent
CreateThread
DuplicateHandle
WriteFile
PeekNamedPipe
ReadFile
TerminateProcess
GetModuleFileNameA
SetConsoleCtrlHandler
LocalFree
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
FreeLibrary
GetModuleHandleA
LoadResource
SizeofResource
LockResource
FindResourceExA
EnumResourceLanguagesA
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
GetProcAddress
GetVersion
GetCurrentProcess
SetLastError
FormatMessageA
GetLocalTime
GetVersionExA
GetSystemInfo
GetLastError
GetTickCount
CloseHandle
Sleep
CreateFileA
DeviceIoControl
GetSystemDirectoryA
DeleteFileA
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
OpenProcess

user32

OpenWindowStationA
SetThreadDesktop
GetProcessWindowStation
GetSystemMetrics
ReleaseDC
GetWindowRect
GetWindowDC
GetDC
SetProcessWindowStation
CloseDesktop
EnumDesktopsA
SendMessageA
GetWindowLongA
TranslateMessage
DispatchMessageA
SetWindowLongA
DestroyWindow
CloseWindowStation
OpenDesktopA
PeekMessageA
GetDesktopWindow
CreateWindowExA
GetThreadDesktop
PostMessageA
wsprintfA
MessageBoxA

advapi32

OpenServiceA
RegEnumKeyA
RegQueryInfoKeyA
RegSaveKeyA
RegDeleteKeyA
RegRestoreKeyA
RegEnumKeyExA
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
CloseServiceHandle
UnlockServiceDatabase
CreateServiceA
LockServiceDatabase
OpenSCManagerA
StartServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
DeregisterEventSource
ChangeServiceConfig2A
DeleteService
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
QueryServiceStatus
RegCreateKeyExA
RegOpenKeyExA
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
FreeSid
LookupAccountSidA
AllocateAndInitializeSid
LookupAccountNameA
InitiateSystemShutdownA
RegCloseKey

shell32

ShellExecuteA
SHGetFileInfoA

mpr

WNetAddConnection2A
WNetCancelConnection2A

netapi32

NetApiBufferFree
NetUserGetInfo
NetQueryDisplayInformation

gdi32

GetObjectA
GetStockObject
SelectPalette
RealizePalette
GetDIBits
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject

ole32

CoInitialize

oleaut32

VariantClear

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??_7out_of_range@std@@6B@
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0logic_error@std@@QAE@ABV01@@Z

psapi

GetModuleFileNameExA
GetProcessMemoryInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
VerFindFileA

shlwapi

SHDeleteValueA
SHDeleteKeyA

Exports

Exports

export_main

Sections

.text
Size: 252KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e223d04858d1ce947dc8112026335113

Headers

File Characteristics

Imports

ws2_32

mfc42

msvcrt

kernel32

user32

advapi32

shell32

mpr

netapi32

gdi32

ole32

oleaut32

msvcp60

psapi

version

shlwapi

Exports

Exports

Sections

.text Size: 252KB - Virtual size: 250KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 44KB - Virtual size: 78KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 252KB - Virtual size: 250KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 44KB - Virtual size: 78KB

.rsrc
Size: 4KB - Virtual size: 1KB