941db5966c722383e29da839b1614d83_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

941db5966c722383e29da839b1614d83_JaffaCakes118
Size

235KB
MD5

941db5966c722383e29da839b1614d83
SHA1

a0c936e05ef93a1baa3ccde5df118ac21f268ab6
SHA256

18e0e81effa4c890b14dcac2727762a78cda7be0db3a48b3d8d7cd921c5dd6a4
SHA512

12c8271626d634fa4a4002209e78df57802e396ed23395bd035b6bdd460e99a15c8f6121abd88846fed4b07a38af86a8ef14ad0080cb25b517b5d6cf092646b9
SSDEEP

6144:RiNUDQaGnaqMnpXFNoZ6oyneIEaykEw3:RiNUDZGp8XHg6oIpL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
941db5966c722383e29da839b1614d83_JaffaCakes118

Files

941db5966c722383e29da839b1614d83_JaffaCakes118
.dll windows:5 windows x86 arch:x86

f94fac7e5cde96b6b555171bce584f5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mswsock.pdb

Imports

msvcrt

wcscmp
wcscpy
strtoul
_except_handler3
malloc
exit
getc
fopen
_adjust_fdiv
_initterm
free
strncmp
wcsncmp
wcsncpy
wcstol
_wcsnicmp
swprintf
strcpy
strlen
strpbrk
_strnicmp
wcschr
atoi
_stricmp
_wcsicmp
wcslen
wcscat
isspace
fgets
fclose
rewind
_errno
sprintf
_write
_iob
fprintf
isdigit
isxdigit
islower
memmove

ntdll

NtSetIoCompletion
NtRemoveIoCompletion
NtClose
NtSetInformationFile
NtCreateEvent
NtSetInformationObject
NtCreateIoCompletion
RtlFreeHeap
RtlRegisterSecureMemoryCacheCallback
RtlAllocateHeap
DbgPrint
NtOpenKey
RtlInitUnicodeString
RtlQueryRegistryValues
RtlGetNtProductType
NtDeviceIoControlFile
NtCreateFile
NtCancelIoFile
RtlInitializeCriticalSectionAndSpinCount
RtlDeleteCriticalSection
NtSetEvent
RtlRaiseStatus
NtWaitForSingleObject
NtDelayExecution
NtLoadDriver
RtlAdjustPrivilege
RtlImpersonateSelf
NtQuerySystemTime
NtAlertThread
NtQueueApcThread
NtClearEvent
NtReadFile
NtWaitForMultipleObjects
RtlNtStatusToDosError
NtQueryEvent
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlDestroyHeap
RtlCreateHeap
RtlDeregisterWaitEx
RtlQueueWorkItem
RtlRegisterWait
NtCreateWaitablePort
NtRequestWaitReplyPort
NtConnectPort
NtReplyPort
RtlIpv6StringToAddressA
RtlIpv6StringToAddressW
RtlInitString
NtQueryValueKey
NtDuplicateObject
NtResetEvent
NtAcceptConnectPort
NtReplyWaitReceivePortEx
NtCompleteConnectPort

kernel32

LocalAlloc
LocalFree
FormatMessageA
ReadFile
WriteFile
SetConsoleMode
GetConsoleMode
CreateFileA
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DelayLoadFailureHook
GetComputerNameExA
WriteProcessMemory
GetCurrentThreadId
IsBadWritePtr
IsBadCodePtr
ResetEvent
SwitchToThread
HeapCreate
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetProcessHeap
HeapDestroy
HeapFree
UnmapViewOfFile
VirtualFree
GetSystemInfo
FormatMessageW
lstrcmpW
TerminateThread
CreateEventW
ResumeThread
SetEvent
lstrlenW
lstrcpyW
VirtualAlloc
CreateEventA
WaitForMultipleObjects
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetOverlappedResult
OpenProcess
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
WaitForSingleObject
GetTickCount
InterlockedExchange
CreateThread
InterlockedExchangeAdd
GetCurrentThread
SetThreadPriority
GetCurrentProcessId
FreeLibraryAndExitThread
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetLastError
Sleep
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
LoadLibraryW
ExpandEnvironmentStringsW
InterlockedDecrement
GetEnvironmentVariableA
CloseHandle
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedIncrement
SleepEx
OutputDebugStringA

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
SetServiceStatus
DeregisterEventSource
RegNotifyChangeKeyValue
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegisterEventSourceA
ReportEventA
RegDeleteValueW
RegOpenCurrentUser
RegQueryInfoKeyA
RegEnumValueW
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerA
RevertToSelf

rpcrt4

UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW

ws2_32

htons
socket
recv
gethostbyname
inet_addr
select
getsockname
inet_ntoa
WSACleanup
WSAGetLastError
connect
ntohs
accept
listen
send
closesocket
bind
WSAProviderConfigChange
WSAIsBlocking
WSARecv
gethostname
WSCInstallProvider
WSCUpdateProvider
WSCDeinstallProvider
getservbyport
getservbyname
WSAEnumProtocolsW
WSAIoctl
ntohl
htonl
WSCEnumProtocols
WSCGetProviderPath
WSAStartup
WSASocketW

ws2help

WahEnumerateHandleContexts
WahRemoveHandleContext
WahReferenceContextByHandle
WahInsertHandleContext
WahDestroyHandleContextTable
WahCreateHandleContextTable

Exports

Exports

AcceptEx
EnumProtocolsA
EnumProtocolsW
GetAcceptExSockaddrs
GetAddressByNameA
GetAddressByNameW
GetNameByTypeA
GetNameByTypeW
GetServiceA
GetServiceW
GetTypeByNameA
GetTypeByNameW
MigrateWinsockConfiguration
NPLoadNameSpaces
NSPStartup
ServiceMain
SetServiceA
SetServiceW
StartWsdpService
StopWsdpService
SvchostPushServiceGlobals
TransmitFile
WSARecvEx
WSPStartup
dn_expand
getnetbyname
inet_network
rcmd
rexec
rresvport
s_perror
sethostname

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

SANONTCP
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f94fac7e5cde96b6b555171bce584f5c

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

rpcrt4

ws2_32

ws2help

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

SANONTCP Size: 47KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 165KB - Virtual size: 164KB

SANONTCP
Size: 47KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 11KB - Virtual size: 11KB