a61061c4695d86b119b088c71bfbbd04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a61061c4695d86b119b088c71bfbbd04_JaffaCakes118
Size

168KB
MD5

a61061c4695d86b119b088c71bfbbd04
SHA1

5c5af926c1469d10e600a5b573548fef5e3e0ec5
SHA256

a4f98b003e5b44580d09c1b7f4edfec18a5b42f36cde05e12e8c326dea953912
SHA512

e38f9de5cd8f01532642f2912990e76d942acfd7bf40a9cd08d3c9cbb7f6f1b2e718e26d5b6ff3d5f429eb41b04c6d7313b3f25f68cb79873630103f3e78dbc7
SSDEEP

3072:CUzX2rrf8Xx4lf/IoObzqFvUxPzmEhPRvkpLfoFkYK+9wiTlDyaoY:1X2rYh4lgoUzqFvUxPzHhNRK+9weyaj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a61061c4695d86b119b088c71bfbbd04_JaffaCakes118

Files

a61061c4695d86b119b088c71bfbbd04_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fd75b30508762c88beabe7b2e1353f2b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostname
listen
inet_addr
closesocket
WSAAsyncSelect
connect
socket
recv
htons
send
inet_ntoa
ntohs
getsockname
WSAGetLastError
accept
WSACleanup
WSAStartup
WSACancelAsyncRequest
WSAAsyncGetHostByName
shutdown
bind

iphlpapi

GetAdaptersInfo

mfc42

ord6385
ord5186
ord354
ord6877
ord6140
ord5442
ord353
ord5651
ord3127
ord3616
ord350
ord3663
ord6883
ord859
ord2764
ord4278
ord6662
ord825
ord500
ord5860
ord6142
ord6010
ord6143
ord860
ord5572
ord2915
ord2614
ord939
ord941
ord5710
ord800
ord4129
ord2763
ord858
ord540
ord801
ord541
ord535
ord773
ord501
ord5600
ord1083
ord5621
ord2818
ord5607
ord559
ord812
ord6144
ord5862
ord5683
ord772
ord3977
ord654
ord341
ord5858
ord5603
ord4202
ord823
ord665
ord1979

msvcrt

??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_onexit
__dllonexit
_wfopen
_errno
wcsstr
_wfindfirst
_wremove
_wmkdir
wcsrchr
_waccess
wcsncpy
_filelengthi64
_wopen
_read
_wchdir
wcslen
wcscat
_wfindfirsti64
_wfindnexti64
_findclose
_lseek
_write
_close
wcscmp
sprintf
_strnicmp
fopen
fclose
fseek
fread
fgetc
wcscpy
_wcsicmp
_CxxThrowException
atoi
_mbscmp
printf
rand
_stricmp
strncpy
getenv
strchr
strncmp
_iob
fprintf
__CxxFrameHandler
wcschr
_except_handler3

kernel32

lstrlenA
GetACP
GetTempPathA
GetTempFileNameA
CopyFileA
OutputDebugStringA
GlobalAlloc
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
InterlockedDecrement
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemInfo
lstrcmpiA
GetSystemDefaultLangID
GetLocaleInfoA
GetComputerNameA
DeleteFileA
DeviceIoControl
GetVersion
MultiByteToWideChar
OpenProcess
GlobalMemoryStatus
PeekNamedPipe
TerminateProcess
WriteFile
GetCurrentProcess
DuplicateHandle
SetConsoleCtrlHandler
SetCurrentDirectoryA
GetVersionExA
WaitForSingleObject
ResetEvent
CreateEventA
SetEvent
FreeLibrary
LoadLibraryA
GetModuleFileNameA
GetQueuedCompletionStatus
GetOverlappedResult
GetTickCount
ReadFile
GetLastError
Sleep
CreateIoCompletionPort
CreateFileA
CloseHandle
GetCurrentDirectoryA
FormatMessageA
LocalFree
GetModuleHandleA
GetProcAddress
SetLastError
GlobalFree

user32

PostMessageA
wsprintfA
DestroyWindow
CreateWindowExA
GetWindowLongA
wsprintfW
DispatchMessageA
SetWindowLongA
TranslateMessage
PeekMessageA

advapi32

QueryServiceStatus
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegCloseKey
DeregisterEventSource
StartServiceA
DeleteService
LockServiceDatabase
CreateServiceA
ChangeServiceConfig2A
UnlockServiceDatabase
OpenServiceA
CloseServiceHandle
SetServiceStatus

shell32

SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

VariantClear
SysAllocString
SysStringLen
SysFreeString
VariantInit

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd75b30508762c88beabe7b2e1353f2b

Headers

File Characteristics

Imports

ws2_32

iphlpapi

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 12KB - Virtual size: 10KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 12KB - Virtual size: 10KB