6324e560e07fa1a43b8aa299d275a3cf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6324e560e07fa1a43b8aa299d275a3cf_JaffaCakes118
Size

312KB
MD5

6324e560e07fa1a43b8aa299d275a3cf
SHA1

4beb4eb78b205b2ceb5cd7f0b9c7f3bc7eefd4af
SHA256

45a0ab51f4e2cd03f2616c980c181198331569eb99bf11c113a9f11d27caaf87
SHA512

3b57d0a3db037750104b9dc74877bb9d73b2da8a2e82a5aab76625577c80bf7b3fa5030a7303ca0f407914cb51539160696590309c6e0ccb6c837f7efd44bb91
SSDEEP

6144:14fSbFrqJebOug5KB0gB6w5nQarFaa16y+o+xnR5Y:CfQbo5u0gb7rFasb+hR5Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6324e560e07fa1a43b8aa299d275a3cf_JaffaCakes118

Files

6324e560e07fa1a43b8aa299d275a3cf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5a40ae136f11af4840918cf45d0873ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Z:\Documents\Visual Studio 2010\Projects\server-side-bot\Release\server-side-bot.pdb

Imports

winhttp

WinHttpWriteData
WinHttpReceiveResponse
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
WinHttpSendRequest
WinHttpCrackUrl

user32

wsprintfW
GetSystemMetrics
wsprintfA

dnsapi

DnsQuery_A
DnsFree

ws2_32

gethostbyname
gethostname
WSAStartup
WSACleanup
inet_addr
htons
socket
connect
send
closesocket
htonl
recv
__WSAFDIsSet
select
listen
bind
accept
WSAGetLastError
shutdown
ioctlsocket
sendto

urlmon

ObtainUserAgentString

advapi32

StartServiceW
RegisterServiceCtrlHandlerW
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenServiceW
CreateServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
SetServiceStatus

iphlpapi

GetAdaptersInfo
GetBestInterface
SendARP

shell32

ShellExecuteExW
SHChangeNotify
ord680

ole32

CoUninitialize
CoCreateGuid
CoInitialize

shlwapi

StrCatW
StrStrIW

kernel32

HeapSize
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
GetCurrentThreadId
GetACP
TlsSetValue
TlsGetValue
TlsAlloc
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
LCMapStringW
WideCharToMultiByte
GetCPInfo
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
TlsFree
LoadLibraryW
CompareStringW
HeapReAlloc
RaiseException
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
DeleteCriticalSection
DecodePointer
EncodePointer
InterlockedDecrement
CloseHandle
WaitForSingleObject
CreateProcessW
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleW
lstrcatW
GetEnvironmentVariableW
ExitProcess
WriteFile
CreateFileW
MoveFileW
lstrcpyW
GetModuleFileNameW
Sleep
LoadLibraryA
SetThreadContext
ReadProcessMemory
GetThreadContext
VirtualProtect
ResumeThread
InitializeCriticalSection
FreeLibrary
LeaveCriticalSection
GetModuleHandleExW
EnterCriticalSection
GetTickCount
IsBadReadPtr
CreateThread
TerminateThread
ExitThread
VirtualFree
MultiByteToWideChar
VirtualAlloc
SetLastError
OutputDebugStringA
GetLastError
IsBadCodePtr
GetCurrentProcess
GetSystemDirectoryW
DeleteFileW
CreateMutexW
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetShortPathNameW
CopyFileW
GetWindowsDirectoryW
CreateEventW
SetEvent
VirtualProtectEx
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempFileNameW
GetTempPathW
GlobalMemoryStatusEx
GetProcessAffinityMask
GetSystemInfo
GetVersionExW
QueryPerformanceFrequency
QueryPerformanceCounter
GetLocalTime

Exports

Exports

CfgGetBotVersion
CfgGetCurrentDomain
CfgGetCurrentPort
CfgReadConfigBinary
CfgReadConfigInteger
CfgReadConfigString
CfgWriteConfigBinary
CfgWriteConfigInteger
CfgWriteConfigString
NetGetStringFromServer
NetGetStringFromServerSpecifyLocation
NetSendDataToServer
NetSendStringToServer
RtlParseString

Sections

.text
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5a40ae136f11af4840918cf45d0873ae

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winhttp

user32

dnsapi

ws2_32

urlmon

advapi32

iphlpapi

shell32

ole32

shlwapi

kernel32

Exports

Exports

Sections

.text Size: 218KB - Virtual size: 218KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 8KB - Virtual size: 30KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 39KB - Virtual size: 41KB

.text
Size: 218KB - Virtual size: 218KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 8KB - Virtual size: 30KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 39KB - Virtual size: 41KB