68a8f9e0da998f2107b0fd8113132670_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

68a8f9e0da998f2107b0fd8113132670_JaffaCakes118
Size

46KB
MD5

68a8f9e0da998f2107b0fd8113132670
SHA1

465195b338f2a24750fe284343e31daf190af9eb
SHA256

ee1a98e7db3a1e530e0182a5d20fcfe1c8a628a1414cc1dcf35f1cd4ee14a4c2
SHA512

81bbf3159b058b107f8b22431534e076df87d8af512b50a8cdc79e68995f94eef4225a52a9d626fba39f1848e9efa5e20013eca09ee6968ffaf423c73c045374
SSDEEP

768:ucNxtofZs6qzW11YA7f46CAybkAOdjSU8N0GSIovU51Cl9B3GHuIEX8S:BP+Cutf4AybkAZPrSxv6Ml9ZXX8S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68a8f9e0da998f2107b0fd8113132670_JaffaCakes118

Files

68a8f9e0da998f2107b0fd8113132670_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b1689d54ad92ddde1e36569e4c09c08f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

getservbyname
EnumProtocolsW
WSASetLastError
getservbyport
TransmitFile
WSAAsyncGetHostByName
s_perror
WSASetBlockingHook
AcceptEx
WSAIsBlocking
htons
getpeername
GetServiceW
ntohs
WSACancelBlockingCall
send
bind
recvfrom
GetServiceA
WSAGetLastError
GetNameByTypeA
ntohl
htonl
WSAAsyncGetProtoByName
gethostbyname
EnumProtocolsA
shutdown
getsockopt
WEP
WSAUnhookBlockingHook
__WSAFDIsSet
getsockname
gethostname
WSAAsyncGetServByName
WSAAsyncGetServByPort
NPLoadNameSpaces
WSAAsyncGetProtoByNumber
GetAddressByNameW
select
GetAcceptExSockaddrs

opengl32

glVertex2i
GlmfBeginGlsBlock
glRasterPos4dv
glColor4sv
glEnable
glRasterPos2fv
glNormal3f
glLightiv
wglDeleteContext
glStencilMask
glHint
glTexCoord1f
glCallList
GlmfInitPlayback
glVertex2fv
glTexCoord4f
glRasterPos3dv
glIndexub
wglDescribeLayerPlane
glClipPlane
glTexCoord2sv
glBitmap
glColorMaterial
glColor3fv
glColor3dv
glGetError
glInterleavedArrays
glIsEnabled
glTexSubImage2D
wglCreateContext
glColor4ui
wglCopyContext
glTexCoord2s
glPushClientAttrib
glGetBooleanv
glVertex3i
wglSwapBuffers

ntdll

ZwQueryDebugFilterState
_atoi64
ZwCompleteConnectPort
RtlpNtCreateKey
RtlIdentifierAuthoritySid
NtQueryVirtualMemory
ZwWaitForMultipleObjects
RtlImpersonateSelf
strncat
RtlGetNtProductType
vsprintf
_fltused
CsrAllocateCaptureBuffer
ZwQueryVirtualMemory
ZwLoadKey2
RtlInitializeCriticalSection
ZwGetWriteWatch
ZwCreateProcess
NtAdjustGroupsToken
NtSetInformationDebugObject
RtlRandom
RtlAreBitsClear
NtQueryOpenSubKeys
ZwAccessCheckByTypeResultList
isspace
RtlDosPathNameToNtPathName_U
RtlCompareUnicodeString
RtlInitializeCriticalSectionAndSpinCount
RtlCompareString
RtlEnlargedUnsignedDivide
_splitpath
ZwGetContextThread

crtdll

wcschr
floor
frexp
strcmp
_strrev
iswalpha
_mbstok
ispunct
_mbsrchr
_sleep
??2@YAPAXI@Z
iswcntrl
isupper
fabs
_flushall
__isascii
_finite
wcstod
putchar
srand
_tzset
_execvpe
_CIsinh
_mbctoupper
_mbsinc
ldiv
difftime
_wtoi
ceil
ungetc
_strcmpi
__fpecode
_vsnprintf
tolower
fgetc

query

?GetPhysicalPath@CWebServer@@QAEKPBGPAGKK@Z
?ReadProperty@CPropStoreManager@@QAEHKKPAUtagPROPVARIANT@@PAI@Z
?Marshall@CDbNumeric@@QBEXAAVPSerStream@@@Z
?Read@CRcovStrmTrans@@QAEKPAXK@Z
?GetWeight@CDbCmdTreeNode@@QBEJXZ
?SetNumberOfSortProps@CCatState@@QAEXI@Z
??0CVirtualString@@QAE@I@Z
?Next@CEnumString@@UAGJKPAPAGPAK@Z
??0CRegAccess@@QAE@KPBG@Z
?Remove@CWorkQueue@@QAEXPAVPWorkItem@@@Z
??0CRegChangeEvent@@QAE@PBGH@Z
?Open@CMmStream@@QAEXPBGKKKKH@Z
?Marshall@CRestriction@@QBEXAAVPSerStream@@@Z
SetupCacheEx
?Init@CRcovStorageHdr@@QAEXK@Z
?GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z
??1CPropertyRestriction@@QAE@XZ
?Commit@CRcovStrmWriteTrans@@QAEXXZ
?UnMarshall@CDbByGuid@@QAEHAAVPDeSerStream@@@Z
?Eof@CMmStreamConsecBuf@@QAEHXZ
??0CSdidLookupTable@@QAE@XZ
?NameToReal@CPidRemapper@@QAEKPBVCFullPropSpec@@@Z
?GetStr@CKeyBuf@@QBEPAGXZ
?GetDWORDParam@CCatalogAdmin@@QAEHPBGAAK@Z
?SetI4@CStorageVariant@@QAEXJI@Z
_StopFWCiSvcWork@16
?DoFailTest@@YGXJ@Z
?IsIISAdminUp@CMetaDataMgr@@SGHAAH@Z

kernel32

VirtualAlloc
HeapAlloc
SetConsoleCursor
GetPrivateProfileStructW
WaitCommEvent
GetConsoleNlsMode
QueryPerformanceCounter
lstrcmpW
GlobalFlags
GetDriveTypeW
ReadConsoleA
LoadLibraryA
IsValidLocale
BuildCommDCBA
IsValidCodePage
SetConsoleScreenBufferSize
GetProcessId
EnumLanguageGroupLocalesA
CreateWaitableTimerA
GetQueuedCompletionStatus
ReadFileScatter
GetCommandLineA
LocalAlloc
GetModuleHandleA
GetNumberOfConsoleInputEvents
WritePrivateProfileStringW
LoadResource
GetCurrentProcessId
FatalAppExitW
AreFileApisANSI
DeleteFileA
UnregisterConsoleIME
GetProfileSectionA
HeapQueryInformation

ws2help

WahEnableNonIFSHandleSupport
WahReferenceContextByHandle
WahOpenNotificationHandleHelper
WahEnumerateHandleContexts
WahCloseApcHelper
WahWaitForNotification
WahOpenApcHelper
WahQueueUserApc
WahDisableNonIFSHandleSupport
WahDestroyHandleContextTable
WahCreateHandleContextTable
WahOpenHandleHelper
WahCloseThread
WahOpenCurrentThread
WahCloseHandleHelper
WahNotifyAllProcesses
WahCreateSocketHandle
WahCloseSocketHandle
WahCloseNotificationHandleHelper
WahCompleteRequest
WahInsertHandleContext
WahRemoveHandleContext
WahCreateNotificationHandle

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1689d54ad92ddde1e36569e4c09c08f

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

opengl32

ntdll

crtdll

query

kernel32

ws2help

Sections

.text Size: 33KB - Virtual size: 33KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 44KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 44KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB