7140138b5a60c18e93d4fb5f0acfe277_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7140138b5a60c18e93d4fb5f0acfe277_JaffaCakes118
Size

33KB
MD5

7140138b5a60c18e93d4fb5f0acfe277
SHA1

520576ee304f6b9f83ee9fd456cfb81d2e4e6926
SHA256

9f0665ebc54dd427a4c617e8e4b87451863bfc657477094438c92cbf99774e19
SHA512

e8322be7c6545e1dba6ea0313679c100dc462c213abd541d1ebb2975d7544ce93e8d2680eebafac5882784abf09227ba9ac6cd71fe0d859f9a25d0c2cf6001fb
SSDEEP

384:gr1bBYViwbDpzcAEJq85yAl1R4LOSbKO99F7lR9onO53DhNjYE0W7:k1bBYVikDBryeA+iIK61l0O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7140138b5a60c18e93d4fb5f0acfe277_JaffaCakes118

Files

7140138b5a60c18e93d4fb5f0acfe277_JaffaCakes118
.exe windows:4 windows x86 arch:x86

04f1e248a48258ff1fd5a0774835b57d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
recv
WSACleanup
WSAGetLastError
closesocket
WSAStartup
socket
htons
connect
send
WSAAsyncSelect

kernel32

GetTickCount
CopyFileA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
SetFileTime
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
GetFileTime
SetFileAttributesA
GetStartupInfoA
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
GetLastError
CreateMutexA
DeleteFileA
ExitProcess
GetModuleFileNameA
SetPriorityClass
GetCurrentProcess
CreateThread
WriteFile
Sleep
ResumeThread
CreateProcessA
ExpandEnvironmentStringsA
GetTempPathA
FreeLibrary
LoadLibraryA
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
GetCurrentProcessId
HeapAlloc
GetCommandLineA
GetFileAttributesA
GetProcessHeap

user32

wsprintfA
DefWindowProcA
ExitWindowsEx
PostQuitMessage
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA

advapi32

ChangeServiceConfigA
QueryServiceStatus
StartServiceA
OpenSCManagerA
OpenServiceA
ControlService
CloseServiceHandle
RegOpenKeyExA
RegRestoreKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

msvcrt

rand
memmove
_stricmp
_itoa
strstr
srand
fclose
fopen
atoi
strncpy
strcspn
__CxxFrameHandler
printf
fprintf
_strlwr
sprintf

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CCM
Size: 512B - Virtual size: 111B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

123456
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

04f1e248a48258ff1fd5a0774835b57d

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

msvcrt

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 10KB - Virtual size: 12KB

.CCM Size: 512B - Virtual size: 111B

123456 Size: 512B - Virtual size: 512B

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 10KB - Virtual size: 12KB

.CCM
Size: 512B - Virtual size: 111B

123456
Size: 512B - Virtual size: 512B