68cb40b30a8dabe527d718f9f9391a49_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

68cb40b30a8dabe527d718f9f9391a49_JaffaCakes118
Size

66KB
MD5

68cb40b30a8dabe527d718f9f9391a49
SHA1

ca99aab41c9d5f06a55ced364bf2d9bd3ff99b4a
SHA256

821edc45e9837ab54be059470e6674f87fd4225b844a40c9b8b1ff22be667e60
SHA512

aba4c3373ed05b11e7be1258ef7ccee27c7e57e1bceae41d7bd34615c2373f9ca6b22b937be5fcb21550ba6f2110829b8329c32baee3087180883cf83c2973f2
SSDEEP

768:0H3C2BrX+mF1JmBwmL0s0es6vo/DFuB6UJvI5cKNtSRePsP6Jpk/52xY0l7URAzP:GdBtfZo6ug95RuoPsP6JCqNURsRbN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68cb40b30a8dabe527d718f9f9391a49_JaffaCakes118

Files

68cb40b30a8dabe527d718f9f9391a49_JaffaCakes118
.exe .vbs windows:4 windows x86 arch:x86 polyglot

4fa117ee09c9cf4162ea6840c168025d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteExA

ws2_32

socket
WSACleanup
connect
recv
closesocket
gethostbyname
WSAStartup
send
htons

msvcp60

?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0_Winit@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

user32

wsprintfA

msvcrt

malloc
srand
_snprintf
printf
rand
time
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
sprintf
__CxxFrameHandler
_except_handler3
strstr
vsprintf
strtok

kernel32

GetStartupInfoA
CreateMutexA
GetLastError
SetErrorMode
CreateThread
GetDriveTypeA
CreateDirectoryA
FindFirstFileA
FindNextFileA
GetModuleHandleA
GetModuleFileNameA
SetFileAttributesA
DeleteFileA
CopyFileA
ExitProcess
GetLocaleInfoA
GetVersionExA
GetTickCount
GetFileAttributesA
Sleep
GetComputerNameA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4fa117ee09c9cf4162ea6840c168025d

Headers

File Characteristics

Imports

advapi32

shell32

ws2_32

msvcp60

user32

msvcrt

kernel32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 29KB - Virtual size: 32KB

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 29KB - Virtual size: 32KB