b131d8d97f165311cd47d6c60484f9d4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b131d8d97f165311cd47d6c60484f9d4_JaffaCakes118
Size

15KB
MD5

b131d8d97f165311cd47d6c60484f9d4
SHA1

5827a6aa7c522e606bfdb10deed7052771f2fb2f
SHA256

c480c90d4416cc2a9d31fbf7e9cdeddd342fb7ef314d0cd436410c75e04e0961
SHA512

76e300ff0c4bae991faaf8938488be8581fdc69bf6d13b61c94121234f6709e7c14010bc41b544ed1407f048898c25979d94c8d0fee5c51f643231630242fcdb
SSDEEP

384:+myE90M/FjxknLJ81CZt41BteRSRNZOxoqQW:JjCsFVk3Zt4SqFW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b131d8d97f165311cd47d6c60484f9d4_JaffaCakes118

Files

b131d8d97f165311cd47d6c60484f9d4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

30633cc1d9a264063ab911b558ec07a1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WriteFile
CreateThread
GetOEMCP
CreateProcessW
GetSystemDirectoryW
GetStartupInfoW
CreatePipe
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLastError
Sleep
MoveFileExA
GetTickCount
GetVersionExW
WideCharToMultiByte
FreeLibrary
LoadLibraryW
lstrcatW
DisableThreadLibraryCalls
DeleteFileW
CreateFileW
ExitProcess
PeekNamedPipe
ReadFile
MultiByteToWideChar
GetProcAddress

user32

GetMessageW
wsprintfW
PostThreadMessageW
wsprintfA

advapi32

RegCloseKey
RegOpenKeyA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteW

ws2_32

WSAStartup
socket
htons
recv
gethostname
gethostbyname
inet_ntoa
closesocket
send
connect

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoW

msvcrt

wcscat
exit
??2@YAPAXI@Z
??3@YAXPAX@Z
printf
_wtoi
_adjust_fdiv
malloc
_initterm
free
strstr
strncmp
atoi
strchr
wcslen
strncat
sprintf
_except_handler3

Exports

Exports

XRegThunkEntry
acmDriverAddA
acmDriverAddW
acmDriverClose
acmDriverDetailsA
acmDriverDetailsW
acmDriverEnum
acmDriverID
acmDriverMessage
acmDriverOpen
acmDriverPriority
acmDriverRemove
acmFilterChooseA
acmFilterChooseW
acmFilterDetailsA
acmFilterDetailsW
acmFilterEnumA
acmFilterEnumW
acmFilterTagDetailsA
acmFilterTagDetailsW
acmFilterTagEnumA
acmFilterTagEnumW
acmFormatChooseA
acmFormatChooseW
acmFormatDetailsA
acmFormatDetailsW
acmFormatEnumA
acmFormatEnumW
acmFormatSuggest
acmFormatTagDetailsA
acmFormatTagDetailsW
acmFormatTagEnumA
acmFormatTagEnumW
acmGetVersion
acmMessage32
acmMetrics
acmStreamClose
acmStreamConvert
acmStreamMessage
acmStreamOpen
acmStreamPrepareHeader
acmStreamReset
acmStreamSize
acmStreamUnprepareHeader

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30633cc1d9a264063ab911b558ec07a1

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

wininet

msvcrt

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 902B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 902B