a30d134db558b2faf5c7bcab9c49bfcf_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a30d134db558b2faf5c7bcab9c49bfcf_JaffaCakes118
Size

61KB
MD5

a30d134db558b2faf5c7bcab9c49bfcf
SHA1

2427b17aed5f4a69e85c6f273e6fcbb443be9750
SHA256

e292a3eb47575451efd4b00711645c684267afb953ec8a56e65ef87bb38022c6
SHA512

485bd71908934a07aa6fa001468b3ac5b2db931d9d38491d3d7ef88339a960874050bbcd821d01f5abb5fc7bfdf2027a668ebd921ae9b86e452a98f97dda4baa
SSDEEP

1536:ElhigFWhCmdjvWIZfwUL4yR2F4liCp8YHnFzxt0:70W9vWIZYUL4gM4liCp8YHnS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a30d134db558b2faf5c7bcab9c49bfcf_JaffaCakes118

Files

a30d134db558b2faf5c7bcab9c49bfcf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

728ee64af113d3389ec136cbb8a6e1da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

shlwapi

StrStrIA
wnsprintfA
StrStrA

ws2_32

socket
closesocket
sendto
setsockopt
getsockname
send
recv
connect
htons
WSAStartup
getsockopt
inet_ntoa
recvfrom

kernel32

RtlUnwind
InterlockedExchange
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpW
GetSystemTime
GetEnvironmentVariableA
GetCommandLineA
GetVersion
MapViewOfFile
CreateFileMappingA
CreateThread
GetCurrentThreadId
CreateMutexA
CloseHandle
OpenMutexA
Sleep
ExitProcess
ExitThread
TerminateThread
OpenThread
lstrcmpA
lstrlenW
IsBadReadPtr
lstrcmpiA
GetTickCount
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
IsBadWritePtr
WaitForSingleObject
ReleaseMutex
SystemTimeToFileTime
GetTimeZoneInformation
GetLastError
DeviceIoControl
CreateFileA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CreateProcessA
VirtualQuery

user32

wsprintfA
GetDC
CharLowerA

dnsapi

DnsQuery_A
DnsExtractRecordsFromMessage_W
DnsRecordListFree

gdiplus

GdipDeleteGraphics
GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
GdipPrivateAddMemoryFont
GdipDeleteFont
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawString
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipCreatePen1
GdipDeleteBrush
GdipFree
GdipAlloc
GdipSaveImageToStream

gdi32

GetTextExtentPoint32A

ole32

CreateStreamOnHGlobal

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 21.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

728ee64af113d3389ec136cbb8a6e1da

Headers

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

gdiplus

gdi32

ole32

Sections

.text Size: 58KB - Virtual size: 57KB

.data Size: 2KB - Virtual size: 21.7MB

.text
Size: 58KB - Virtual size: 57KB

.data
Size: 2KB - Virtual size: 21.7MB