6916e0850e56f15b1db05909a7d4cc5e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6916e0850e56f15b1db05909a7d4cc5e_JaffaCakes118
Size

119KB
MD5

6916e0850e56f15b1db05909a7d4cc5e
SHA1

731c5de08189bea5fa114472ffd0059c486dd12d
SHA256

14886e5fa1df3c3bee80886dc0a1660eead8ebf476ea3ed75da6563a36993383
SHA512

c8acba795bf18d28793a4b650fc241a215796c612a501e33a35a6c7e5fc124ee59fbabacf7cb55d118b1d0329e3d88dfb74d6d11a7c8bb7961bff6aabc9b1011
SSDEEP

3072:lvkRcZrfVeH/F5f1BhnWXYsuI27xv4lgsGleS:qKZY/F5tBYXYsB2722sG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6916e0850e56f15b1db05909a7d4cc5e_JaffaCakes118

Files

6916e0850e56f15b1db05909a7d4cc5e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

814fa6d2fe87f7f41ad43c468ea07c80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA

kernel32

ClearCommError
CloseHandle
CreateFileA
DeleteFileA
EscapeCommFunction
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCommState
GetCommTimeouts
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
LCMapStringA
LoadLibraryA
MultiByteToWideChar
PurgeComm
RaiseException
ReadFile
RtlUnwind
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetupComm
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile

user32

EnumThreadWindows
MessageBoxA
wsprintfA

Exports

Exports

_COMM_Backup
_COMM_BackupBattery
_COMM_LoadBoots
_COMM_Read
_COMM_ReadMemory
_COMM_Reboot
_COMM_UpdateBatteryBlock
_COMM_UpdateFlashIMEI
_COMM_UpdateIMEIBlocks
_COMM_Write
_MAP_LoadBatteryMap
_MAP_LoadLog
_MAP_LoadMap
_MAP_SaveBatteryMap
_MAP_SaveLog
_MAP_SaveMap
_MISC_AdjustAddresses
_MISC_C30Like
_MISC_CRCCheck
_MISC_Calculate8BitChecksum
_MISC_CheckFileName
_MISC_ConvertProvider
_MISC_DefaultLogCallout
_MISC_FinishRedirectionOfError
_MISC_GaugeDone
_MISC_GaugeInit
_MISC_GaugeUpdate
_MISC_GetBuild
_MISC_GetCOMPort
_MISC_GetCurrentPhonemodel
_MISC_GetEEPROMAddress
_MISC_GetEmulation
_MISC_GetErrorCode
_MISC_GetFileSize
_MISC_GetFlashIMEI
_MISC_GetMCUStartAddress
_MISC_GetNextToken
_MISC_GetPhoneInfoPtr
_MISC_GetPhoneModel
_MISC_GetPhoneModelName
_MISC_HandleLogString
_MISC_HexCharToByte
_MISC_HexToInt
_MISC_OpenEmulatedFlashFile
_MISC_PossibleToUpdateFlashIMEI
_MISC_ReadHeader
_MISC_ReadHexBlock
_MISC_SetCOMPort
_MISC_SetCurrentPhonemodel
_MISC_SetDebugLevel
_MISC_SetEmulation
_MISC_SetErrorCode
_MISC_SetGauge
_MISC_SetLogCallout
_MISC_SetRedirection
_MISC_Sleep
_MISC_StartRedirectionOfError
_MISC_SwapDword
_MISC_WriteHeader
_REG_Load
_REG_Save
_SEC_AdjustFlashIMEI
_SEC_BCDIMEIToNormalIMEI
_SEC_CreateBlocks5009And76
_SEC_CreateCRCDigit
_SEC_CreateIMEISpecificBlocks
_SEC_GetBlockLen
_SEC_NormalIMEIToBCDIMEI
_SEC_RecreateBlocks5009And76
_SEC_RecreateIMEI
_SEC_RecreateIMEISpecificBlocks
_TTY_CloseCOMPort
_TTY_GetNumberOfReceivedBytes
_TTY_GetReadTimeout
_TTY_GetSpeed
_TTY_OpenCOMPort
_TTY_ReadComm
_TTY_SetReadTimeout
_TTY_SetSpeed
_TTY_WriteComm
___CPPdebugHook

Sections

.text
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

814fa6d2fe87f7f41ad43c468ea07c80

Headers

File Characteristics

Imports

advapi32

kernel32

user32

Exports

Exports

Sections

.text Size: 81KB - Virtual size: 84KB

.data Size: 26KB - Virtual size: 560KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 2KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 8KB

.text
Size: 81KB - Virtual size: 84KB

.data
Size: 26KB - Virtual size: 560KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 8KB