a69757596648293c0e7c949eb7b489d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a69757596648293c0e7c949eb7b489d2_JaffaCakes118
Size

72KB
MD5

a69757596648293c0e7c949eb7b489d2
SHA1

8843cc41d973ee9bf6abbb58be6c4c4737afc2d5
SHA256

46d624927ed58cad905f8435cb7e1ee7be4000fed86e0a56574a3670bd9dbe70
SHA512

4e90e4a231216c938234a9091667a9102afc52ba680b83f3ed9c75ab8f264b440d8ac718aa13e47a55f1a53339803b30c7aef314f0d7da35600bc5a4d58a3190
SSDEEP

768:h7HmkleqbfkUvzjCm9rDKynL4OaYl/WC86pKIeUFu+N8Vo0vW+kIOLR8:Zm+ebynL4OX/WCxp7l1Nd0vWNIo8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a69757596648293c0e7c949eb7b489d2_JaffaCakes118

Files

a69757596648293c0e7c949eb7b489d2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

36fb4e1dd9ec0050f827e5f061047ef3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyExA

kernel32

SetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
LocalFree
CloseHandle
FreeLibrary
CreateThread
LoadLibraryA
GetModuleFileNameA
CreateEventA
LocalAlloc
EnterCriticalSection
InterlockedIncrement
SetEvent
FreeLibraryAndExitThread
WaitForSingleObject
GetLastError
RtlMoveMemory
RtlZeroMemory
GetCurrentProcessId
GetProcAddress
lstrlenA
IsBadCodePtr
CreateMutexA
ReleaseMutex
lstrcpyA
TlsFree
TlsAlloc
ExpandEnvironmentStringsA
InterlockedDecrement
TlsSetValue
TlsGetValue
MultiByteToWideChar
ResetEvent
WaitForMultipleObjectsEx
GetWindowsDirectoryA
GetSystemDirectoryA
GetVersionExA
GetComputerNameA
IsBadWritePtr
WideCharToMultiByte
GetModuleHandleA
lstrcmpA

msvcrt

fopen
islower
isxdigit
isdigit
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
fclose
_stricmp
isspace
strchr
atoi
fgets
wcscpy
wcslen
free

user32

DispatchMessageA
wsprintfA
TranslateMessage
PeekMessageA
PostMessageA

ws2help

WahGetContext
WahCloseApcHelper
WahOpenApcHelper
WahOpenHandleHelper
WahCreateContextTable
WahDestroyContextTable
WahCloseSocketHandle
WahCreateSocketHandle
WahCloseHandleHelper
WahRemoveContext
WahSetContext
WahOpenCurrentThread
WahCloseThread
WahQueueUserApc
WahCompleteRequest

Exports

Exports

WEP
WPUCompleteOverlappedRequest
WSAAccept
WSAAddressToStringA
WSAAddressToStringW
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncSelect
WSACancelAsyncRequest
WSACancelBlockingCall
WSACleanup
WSACloseEvent
WSAConnect
WSACreateEvent
WSADuplicateSocketA
WSADuplicateSocketW
WSAEnumNameSpaceProvidersA
WSAEnumNameSpaceProvidersW
WSAEnumNetworkEvents
WSAEnumProtocolsA
WSAEnumProtocolsW
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAGetQOSByName
WSAGetServiceClassInfoA
WSAGetServiceClassInfoW
WSAGetServiceClassNameByClassIdA
WSAGetServiceClassNameByClassIdW
WSAHtonl
WSAHtons
WSAInstallServiceClassA
WSAInstallServiceClassW
WSAIoctl
WSAIsBlocking
WSAJoinLeaf
WSALookupServiceBeginA
WSALookupServiceBeginW
WSALookupServiceEnd
WSALookupServiceNextA
WSALookupServiceNextW
WSANtohl
WSANtohs
WSAProviderConfigChange
WSARecv
WSARecvDisconnect
WSARecvFrom
WSARemoveServiceClass
WSAResetEvent
WSASend
WSASendDisconnect
WSASendTo
WSASetBlockingHook
WSASetEvent
WSASetLastError
WSASetServiceA
WSASetServiceW
WSASocketA
WSASocketW
WSAStartup
WSAStringToAddressA
WSAStringToAddressW
WSAUnhookBlockingHook
WSAWaitForMultipleEvents
WSApSetPostRoutine
WSCDeinstallProvider
WSCEnableNSProvider
WSCEnumProtocols
WSCGetProviderPath
WSCInstallNameSpace
WSCInstallProvider
WSCUnInstallNameSpace
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getpeername
getprotobyname
getprotobynumber
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36fb4e1dd9ec0050f827e5f061047ef3

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ws2help

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 5KB

.idata Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 4KB - Virtual size: 2KB