84b56149f4401406af2addd0aa880855_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

84b56149f4401406af2addd0aa880855_JaffaCakes118
Size

27KB
MD5

84b56149f4401406af2addd0aa880855
SHA1

6d6ba401bb7fac55b88af8076eca86d4622cf7bf
SHA256

261e7b4b20c84e7cc3502bdedb97ff270fe3f5eaa60ff6700503031ddc5223b0
SHA512

05e71f74ea06087e34de9b791657ef11035ad0058ac828f0ac4a00a425c5bff354824cebd0f6dde4c03100239745c9d91cb3628660799da51dfc6a8dcf476516
SSDEEP

768:Iv3WijQ3Dvt6E56UmpUJoGwdhCOpdD8klbTpqibsm:Iv3HjUDvgE56UmpUOsO/0ib5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84b56149f4401406af2addd0aa880855_JaffaCakes118

Files

84b56149f4401406af2addd0aa880855_JaffaCakes118
.exe windows:4 windows x86 arch:x86

08974d4fbd73a39036c9150e513d3d6b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htonl
inet_ntoa
gethostbyname
ntohl
WSAStartup
gethostname
WSACleanup

mfc42

ord6663
ord356
ord354
ord858
ord4129
ord800
ord4278
ord536
ord540
ord2770
ord2781
ord4058
ord3181
ord939
ord3178
ord2915
ord5186
ord5773
ord5442
ord6385
ord1979
ord1980
ord665
ord668
ord389
ord537
ord5207
ord2393
ord924
ord941
ord2764
ord2614
ord2818
ord690
ord535
ord5710

msvcrt

_controlfp
_except_handler3
_chdir
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
??3@YAXPAX@Z
__dllonexit
_mbscmp
_mbsicmp
fopen
fprintf
fclose
strcat
_stricmp
strcpy
strlen
strstr
__CxxFrameHandler
memset
strcmp
sprintf
__getmainargs
_onexit
__set_app_type

kernel32

GetProcAddress
GetLocalTime
SetLocalTime
GetSystemTime
SetSystemTime
LoadLibraryA
CreateProcessA
ExpandEnvironmentStringsA
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
GetTempPathA
ExitProcess
GetCurrentProcess
CopyFileA
DeleteFileA
GetDriveTypeA
CreateThread
CreateMutexA
GetTickCount
SetFileAttributesA
GetModuleHandleA
GetStartupInfoA
GetLastError
Sleep
WinExec
GetSystemDirectoryA
FreeLibrary

user32

SetTimer
GetCursorPos
WindowFromPoint
GetParent
GetWindowTextA
PostMessageA
DefWindowProcA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA

advapi32

AdjustTokenPrivileges
OpenProcessToken
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
QueryServiceStatus
RegOpenKeyExA
CloseServiceHandle
StartServiceA
OpenServiceA
CreateServiceA
OpenSCManagerA
RegSetValueExA
RegCloseKey
LookupPrivilegeValueA

urlmon

URLDownloadToFileA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

08974d4fbd73a39036c9150e513d3d6b

Headers

File Characteristics

Imports

ws2_32

mfc42

msvcrt

kernel32

user32

advapi32

urlmon

msvcp60

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 7KB

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 7KB