b1c5a39a0a3a3994b24397e172dea005_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b1c5a39a0a3a3994b24397e172dea005_JaffaCakes118
Size

256KB
MD5

b1c5a39a0a3a3994b24397e172dea005
SHA1

6758b85275d488bd2681f848a8b1b157cf1764b4
SHA256

635b0ea0a60f4d1922d947c0b69b68def412076904e4c4907e02d4477ae43b14
SHA512

a355e56be1d51b4e640de9f465def15f638a19f2efde1c358962a6a95cf091f03c2de0f8fd48df3c262fa71cb31e9612ebf323bf62ed9667760104e25dc17b8b
SSDEEP

6144:j+23ba4+mRO7nj8Jw1qG9Gsb0SkXj6PzYriH3YtfMe:jFa4+mRO7jULZriH3YtfMe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1c5a39a0a3a3994b24397e172dea005_JaffaCakes118

Files

b1c5a39a0a3a3994b24397e172dea005_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3f80595472212f0edce1e684906c3d20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
_adjust_fdiv
__setusermatherr
__p__fmode
__getmainargs
ftell
_initterm
_XcptFilter
_exit
_iob
_acmdln
_onexit
__dllonexit
??1type_info@@UAE@XZ
__CxxFrameHandler
?terminate@@YAXXZ
_abnormal_termination
_ftime
_endthreadex
_beginthreadex
_except_handler3
fgets
__set_app_type
fprintf
printf
perror
malloc
fread
_errno
strerror
fflush
sscanf
calloc
mbstowcs
wcscpy
strcat
toupper
fputc
wcscat
strtok
_ftol
rand
srand
fwrite
fopen
fseek
_controlfp
isdigit
sprintf
wcstombs
free
exit
strncmp
atof
memcmp
strchr
strncat
system
atoi
strcmp
strcpy
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
fclose
_strdup
_memccpy
_itoa
_stricmp
_purecall
??3@YAXPAX@Z

msvcp60

?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ

kernel32

ResumeThread
WaitForMultipleObjects
InitializeCriticalSection
GetModuleHandleA
ResetEvent
GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
GetProcessAffinityMask
RaiseException
TlsSetValue
DeleteCriticalSection
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
SuspendThread
GetThreadContext
SetThreadContext
SetEvent
WaitForSingleObject
CreateFileA
InterlockedDecrement
TransactNamedPipe
MultiByteToWideChar
GetLastError
CopyFileA
GetModuleFileNameA
OpenProcess
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
GetTickCount
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
ExitProcess
DeleteFileA
GetSystemDirectoryA
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ReadFile
CloseHandle
TerminateProcess

user32

wsprintfA
ExitWindowsEx

advapi32

DeleteService
ControlService
RegDeleteValueA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
RegSetValueExA
RegCloseKey
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA

shell32

ShellExecuteA

ws2_32

sendto
htonl
WSAIoctl
inet_addr
WSAStartup
WSASetLastError
getsockopt
gethostname
setsockopt
ntohs
ioctlsocket
getpeername
gethostbyname
send
recv
WSAGetLastError
select
__WSAFDIsSet
inet_ntoa
gethostbyaddr
getservbyname
shutdown
getsockname
accept
bind
listen
closesocket
socket
htons
connect
WSACleanup
WSASocketA
ntohl

netapi32

NetUseDel
NetApiBufferFree
NetUseAdd
NetUserEnum
NetRemoteTOD
NetScheduleJobAdd
NetShareEnum

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetCancelConnection2A
WNetAddConnection2A

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

dnsapi

DnsQuery_A

Exports

Exports

pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getw32threadhandle_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wonk
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3f80595472212f0edce1e684906c3d20

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

netapi32

mpr

psapi

dnsapi

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 161KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 44KB - Virtual size: 60KB

.wonk Size: 16KB - Virtual size: 16KB

.text
Size: 164KB - Virtual size: 161KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 44KB - Virtual size: 60KB

.wonk
Size: 16KB - Virtual size: 16KB