8c1212fa276831de40d100c7dfa54c32_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8c1212fa276831de40d100c7dfa54c32_JaffaCakes118
Size

45KB
MD5

8c1212fa276831de40d100c7dfa54c32
SHA1

3b1d4d0405583238a46666dddcaa68724d6fb769
SHA256

fb51b4f929a1d7b78435c038e25a0bd8462a9a3243eee7a44b0f5591434edacb
SHA512

7f8faeaff3e8c976c129ea231d0a17261080577409648a469644c0a6d33ec926ab59810ee3fcf2cd0893fb4026d7da9e1f5e09024802c5ef96ba243599e63dfe
SSDEEP

768:pPJ/UULkisoExTrr/ReDE3bVPfhU5zt4gy0tFTLxpvrgQhPDLUb/dWvwS2IeTBp1:TZonoExrgW3U5n/rEyPv2S2Pn/F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c1212fa276831de40d100c7dfa54c32_JaffaCakes118

Files

8c1212fa276831de40d100c7dfa54c32_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
recv
WSACleanup
WSAGetLastError
closesocket
WSAStartup
socket
connect

kernel32

GetCommandLineA
GetStartupInfoA
Process32First
Process32Next
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
SetPriorityClass
GetCurrentProcess
ExitProcess
CloseHandle
CreateMutexA
lstrcpyA
lstrcatA
lstrlenA
CreateEventA
GetModuleFileNameA
GetWindowsDirectoryA
GetCurrentThreadId
ResumeThread
CreateThread
DeleteFileA
GlobalMemoryStatus
GetCurrentProcessId
HeapAlloc
GetProcessHeap
TerminateProcess
WriteProcessMemory
GetThreadContext
ReadProcessMemory
GetModuleHandleA

user32

DispatchMessageA
TranslateMessage
SendMessageA
ShowWindow
CreateWindowExA
RegisterClassA
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
DefWindowProcA
ExitWindowsEx
UpdateWindow

advapi32

RegSetValueExA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

ntdll

RtlUnwind
ZwUnmapViewOfSection
sprintf
strcspn
strncpy
atoi
strstr
_strlwr
_itoa
_strupr

msvcirt

??_Dofstream@@QAEXXZ
??_Difstream@@QAEXXZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?close@ifstream@@QAEXXZ
?write@ostream@@QAEAAV1@PBDH@Z
?read@istream@@QAEAAV1@PADH@Z
?open@ofstream@@QAEXPBDHH@Z
??0ofstream@@QAE@XZ
?open@ifstream@@QAEXPBDHH@Z
?openprot@filebuf@@2HB
??0ifstream@@QAE@XZ

msvcrt

printf
__CxxFrameHandler
malloc

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

ntdll

msvcirt

msvcrt

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 6KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 6KB