a06a05d89edd670b0b7741df91e2bb83_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a06a05d89edd670b0b7741df91e2bb83_JaffaCakes118
Size

295KB
MD5

a06a05d89edd670b0b7741df91e2bb83
SHA1

7ac007fee803065598b1b581eb2c111733220375
SHA256

14b1e09e1908d73771e1385f9ae96438864480e11f187aa0066dd060bfad8c39
SHA512

16111cd222da50d50b469ec0b6ceabbe8bd0285bb55d298fa339b8d60aba37f41077ff2be440391d93248d5af2f9a42f828491c6cf1fec44681099a3762f2664
SSDEEP

6144:LzSh84RPqMdFGGy2ei1uQwUx1LqjkfOrpHdjYz:bohLLHOrxm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a06a05d89edd670b0b7741df91e2bb83_JaffaCakes118

Files

a06a05d89edd670b0b7741df91e2bb83_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebcf80a47c1d2b7383a33f3523c70630

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__CxxFrameHandler
__dllonexit
strrchr
_itoa
_strdate
_strtime
fputs
realloc
time
fgets
_endthreadex
_beginthreadex
_except_handler3
sprintf
isdigit
calloc
fprintf
printf
perror
_errno
strerror
fflush
sscanf
wcstombs
mbstowcs
__p__commode
strcat
fputc
wcscat
strtok
_ftol
rand
srand
fwrite
fopen
fseek
ftell
fread
fclose
malloc
free
exit
_strdup
_memccpy
_stricmp
strncmp
atof
__p__fmode
memmove
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
memcmp
strchr
_vsnprintf
strcmp
strncat
memcpy
strstr
??2@YAPAXI@Z
strncpy
??3@YAXPAX@Z
memset
strcpy
strlen
system
atoi
_purecall
__set_app_type
_controlfp
wcscpy
_strnicmp

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

GetThreadPriority
GetStartupInfoA
SetEndOfFile
SetFileTime
RemoveDirectoryA
GetFileSize
GetFileTime
SetFilePointer
FindFirstFileA
FindNextFileA
SystemTimeToFileTime
HeapReAlloc
HeapAlloc
HeapDestroy
HeapFree
FindClose
HeapCreate
MulDiv
GetTempPathA
CreateDirectoryA
lstrcpynA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
RaiseException
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
ResumeThread
WaitForSingleObject
ResetEvent
InterlockedDecrement
TransactNamedPipe
MultiByteToWideChar
GetLastError
DeleteFileA
GetSystemDirectoryA
GetTickCount
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
Sleep
ReadFile
CloseHandle
TerminateProcess
CreateFileA
WaitNamedPipeA
CreateNamedPipeA
WriteFile
GetStdHandle
AllocConsole
FreeConsole
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
OpenProcess
GetModuleFileNameA
CopyFileA

user32

CharPrevA
ExitWindowsEx
wsprintfA

advapi32

CloseServiceHandle
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
RegSetValueExA
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ws2_32

ioctlsocket
connect
send
getservbyname
listen
getsockname
WSAGetLastError
shutdown
WSACleanup
getpeername
select
__WSAFDIsSet
getsockopt
WSASetLastError
WSAStartup
ntohl
WSASocketA
setsockopt
gethostbyname
inet_ntoa
htonl
htons
sendto
gethostname
socket
bind
WSAIoctl
closesocket
recv
ntohs
inet_addr
accept
gethostbyaddr

netapi32

NetUseDel
NetApiBufferFree
NetShareEnum
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD
NetUseAdd

mpr

WNetAddConnection2A
WNetCancelConnection2W
WNetCancelConnection2A
WNetAddConnection2W

psapi

GetModuleBaseNameA
EnumProcesses
EnumProcessModules

dnsapi

DnsQuery_A

Sections

.text
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wonk
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ebcf80a47c1d2b7383a33f3523c70630

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

netapi32

mpr

psapi

dnsapi

Sections

.text Size: 204KB - Virtual size: 200KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 44KB - Virtual size: 60KB

.wonk Size: 16KB - Virtual size: 16KB

.text
Size: 204KB - Virtual size: 200KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 44KB - Virtual size: 60KB

.wonk
Size: 16KB - Virtual size: 16KB