af88fdd93687523fe233fed09d5508db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

af88fdd93687523fe233fed09d5508db_JaffaCakes118
Size

56KB
MD5

af88fdd93687523fe233fed09d5508db
SHA1

eb9cb99f565b1cba576c9610489913d59a9712e6
SHA256

a31a7da40325d56da426711f4dfb93fe24f86f4f939fcfac3e5ad693f7ad11a8
SHA512

00ad8c9d000a3533a2f83a7195d2010bbe10f48da54f4856e00695ecf7ca0d06e880096963075c1c44fa88df2885fc093e50a25fc33d6b44c7ea6bdf21434003
SSDEEP

768:7EQBESUJIC0wWGbas15Y2RrvzxGyG5ZNJB4DZPZs+kEhhjrBDRMNY+JyVd:7EQSpJewdbPfx4DJBCBBhhjrBDRMq+AT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af88fdd93687523fe233fed09d5508db_JaffaCakes118

Files

af88fdd93687523fe233fed09d5508db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b39e0e55d94ef546414be2e8596950c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
ntohs
WSAGetLastError
WSAStartup
WSACleanup
gethostbyaddr
inet_ntoa
inet_addr

iphlpapi

SendARP

kernel32

lstrlenW
lstrlenA
SetEvent
SystemTimeToFileTime
GetLocalTime
CreateEventA
WaitForSingleObject
GetExitCodeThread
WaitForMultipleObjects
Sleep
FreeLibrary
LoadLibraryA
OpenMutexA
GetCurrentThreadId
GetModuleFileNameA
CreateSemaphoreA
OpenEventA
OpenSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
GetTickCount
QueryPerformanceCounter
ExitProcess
FindResourceA
LoadResource
InitializeCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentProcessId
GetLastError
GetProcessHeap
CreateMutexA
LoadLibraryW
GetProcAddress

advapi32

CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
CryptDeriveKey
CryptGetHashParam

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantInit
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
VariantClear

samlib

SamiSetDSRMPassword
SamEnumerateAliasesInDomain
SamQueryInformationUser
SamLookupIdsInDomain
SamOpenAlias
SamiLmChangePasswordUser
SamRemoveMultipleMembersFromAlias
SamiEncryptPasswords
SamTestPrivateFunctionsDomain
SamAddMemberToGroup
SamiChangeKeys
SamChangePasswordUser2
SamRidToSid

snmpapi

SnmpUtilOctetsFree
SnmpUtilPrintOid
SnmpUtilOidNCmp
SnmpTfxClose

Sections

.edata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 8KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b39e0e55d94ef546414be2e8596950c

Headers

File Characteristics

Imports

ws2_32

iphlpapi

kernel32

advapi32

ole32

oleaut32

samlib

snmpapi

Sections

.edata Size: 10KB - Virtual size: 9KB

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 48KB

.edata Size: 8KB - Virtual size: 59KB

.data Size: 6KB - Virtual size: 361KB

.edata Size: 10KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.edata
Size: 10KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 48KB

.edata
Size: 8KB - Virtual size: 59KB

.data
Size: 6KB - Virtual size: 361KB

.edata
Size: 10KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB