77ea70b6f7f76eefe158cd3160023196_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

77ea70b6f7f76eefe158cd3160023196_JaffaCakes118
Size

28KB
MD5

77ea70b6f7f76eefe158cd3160023196
SHA1

daafa4755f4baa28b952eb1e783dd46f7f88040b
SHA256

0abfa452bf621e4365406dd03e0dd89e7a5308b77a117b0bb7fd6b9fdb6dd0e9
SHA512

b6457ae77d4b78a7f1389ca03755cb7344c0bcf736d8215e17aa4b8de567ff164139d4f8fe5b09473fd413e8c03db139e1d8b2253c5aac67d3b34e8fe588b1dd
SSDEEP

192:0EkOhjkU+LtZ70SZiRGLoIidlRg1hmqd+dxWR0F/wTz3CF/Cmmfmtzz0:0EvN2ERWidlRCb+d00FHFZmfmC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77ea70b6f7f76eefe158cd3160023196_JaffaCakes118

Files

77ea70b6f7f76eefe158cd3160023196_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c687054bd09f440d1cd294b1bcd0bf32

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetProcessHeap
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
VirtualAlloc
VirtualProtect
VirtualFree
HeapReAlloc
HeapFree
GetCurrentProcess
GetProcessId
SetProcessShutdownParameters
SetErrorMode
FreeLibrary
Sleep
WriteFile
LoadLibraryA
GetProcAddress
CreateFileA
CreateThread
CloseHandle
VirtualQuery
GetWindowsDirectoryA

dnsapi

DnsQuery_A

msvcrt

_mbschr
free
malloc
memcmp
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CxxFrameHandler
memset
_stricmp
_itoa
_strupr
strcat
strcpy
??2@YAPAXI@Z
strlen
memcpy
time
atol
strcmp
??3@YAXPAX@Z
sprintf
atoi
strchr

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

user32

DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
LoadCursorA
LoadIconA
UpdateWindow
ShowWindow
CreateWindowExA
SetTimer
MoveWindow
GetSystemMetrics
SetWindowLongA
PostQuitMessage
EndPaint
BeginPaint

ws2_32

htons
setsockopt
inet_ntoa
inet_addr
select
recv
send
socket
WSAStartup
WSAConnect
closesocket

Exports

Exports

start

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c687054bd09f440d1cd294b1bcd0bf32

Headers

File Characteristics

Imports

kernel32

dnsapi

msvcrt

msvcp60

user32

ws2_32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 2KB

Shared Size: 4KB - Virtual size: 12B

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 2KB

Shared
Size: 4KB - Virtual size: 12B

.reloc
Size: 4KB - Virtual size: 1KB