b2f0b616692f9d4c7537fede46e02a88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b2f0b616692f9d4c7537fede46e02a88_JaffaCakes118
Size

387KB
MD5

b2f0b616692f9d4c7537fede46e02a88
SHA1

ec316df91d001f9bfa2926dd23a8d736f2b5964c
SHA256

17fddcb69abd1d8abc359dc009127b62a5a3d692f66a1f0fd0709912c141076f
SHA512

3fd6a86d839432c68ebefa26479684f544564f77d0bc53fb14c8e58396f8dcdda3f30a93bf44ad9a38bb80e90e6786f6c999166550158786160620fcaf3b6c4f
SSDEEP

6144:7eYUQClY2WvPB2mdCZqMSLwZeieNQWxXcMer6GdV2I/fmQboNQB5GwOilDthX8Tt:KxJWR1CZEDtCWO9NdBqI5JlL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2f0b616692f9d4c7537fede46e02a88_JaffaCakes118

Files

b2f0b616692f9d4c7537fede46e02a88_JaffaCakes118
.exe windows:5 windows x86 arch:x86

987a4bd734f7bbbbf336938fcd50ef4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glGetMapiv
glRasterPos3iv
glNormal3sv
glTexCoord1sv
glIndexfv
wglSetPixelFormat
glVertex2s
glGetLightfv
glTexCoord2s
glTexParameterfv
glViewport
glFinish
glPassThrough
glColor3s
glDisable
glRasterPos3dv
glColor3i
glLoadMatrixf
glRectiv
glVertex3d
wglSwapLayerBuffers
glGetString
glPointSize
glIsList
glCallLists
wglUseFontBitmapsW
glCopyTexSubImage2D
glPopName
glPopMatrix
glDepthFunc
glCopyPixels
glEvalPoint2
glTexGendv
glCopyTexImage2D
glVertex2f
glPixelStorei
glTexCoord4d
glIsTexture
wglGetProcAddress
glColor4us
glRasterPos2s

iphlpapi

_PfAddFiltersToInterface@24
IcmpCloseHandle
_PfBindInterfaceToIPAddress@12
InternalGetIpAddrTable
InternalGetTcpTable
_PfMakeLog@4
DisableMediaSense
DeleteIpForwardEntry
InternalGetUdpTable
InternalDeleteIpForwardEntry
GetAdaptersInfo
GetUdpStatistics
_PfRemoveGlobalFilterFromInterface@8
SetAdapterIpAddress
UnenableRouter
GetUniDirectionalAdapterInfo
IcmpSendEcho
SetIpStatistics
SetTcpEntry
GetAdapterIndex
InternalSetIpForwardEntry
GetIpAddrTable
EnableRouter
NhpAllocateAndGetInterfaceInfoFromStack
GetTcpStatisticsEx
DeleteIpNetEntry
GetIpStatisticsEx
GetUdpStatisticsEx
CreateIpNetEntry
InternalSetIpStats
AllocateAndGetIpAddrTableFromStack
GetIcmpStatistics
InternalGetIpForwardTable
NotifyAddrChange
IpReleaseAddress
IcmpSendEcho2
IpRenewAddress
GetFriendlyIfIndex

ntprint

PSetupInstallICMProfiles
PSetupInstallInboxDriverSilently
PSetupDriverInfoFromName
PSetupEnumMonitor
PSetupGetPathToSearch
PSetupInstallPrinterDriver
PSetupGetSelectedDriverInfo
PSetupDestroyDriverInfo3
PSetupCreatePrinterDeviceInfoList
PSetupShowBlockedDriverUI
PSetupInstallMonitor
PSetupAssociateICMProfiles
PSetupSelectDeviceButtons
ServerInstallW
PSetupSetSelectDevTitleAndInstructions
PSetupFreeMem
PSetupCreateDrvSetupPage
PSetupIsDriverInstalled
ClassInstall32
PSetupDestroySelectedDriverInfo
PSetupSelectDriver
PSetupIsCompatibleDriver
PSetupPreSelectDriver
PSetupDestroyMonitorInfo
PSetupGetDriverInfo3
PSetupIsTheDriverFoundInInfInstalled
PSetupBuildDriversFromPath
PSetupGetLocalDataField

msvcrt40

fwrite
isalnum
?clog@@3Vostream_withassign@@A
?ws@@YAAAVistream@@AAV1@@Z
_wutime
isalpha
?lockptr@ios@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
_wcreat
??0streambuf@@IAE@PADH@Z
_local_unwind2
??0ostrstream@@QAE@XZ
vfwprintf
_wtol
cosh
??4ofstream@@QAEAAV0@ABV0@@Z
??5istream@@QAEAAV0@AAD@Z
fclose
??0Iostream_init@@QAE@XZ
iswspace
??_8istrstream@@7B@
?raw_name@type_info@@QBEPBDXZ
??_Gbad_typeid@@UAEPAXI@Z
fgetc
ungetwc
?get@istream@@IAEAAV1@PADHH@Z
__wargv
??_7fstream@@6B@
__threadhandle
?close@fstream@@QAEXXZ
wcsncpy

kernel32

GlobalReAlloc
RemoveDirectoryA
GetModuleHandleExA
LoadLibraryExW
VerSetConditionMask
FindResourceExA
ResetEvent
GetComputerNameExA
TlsFree
SetLastError
IsBadReadPtr
ChangeTimerQueueTimer
GetSystemDirectoryW
WriteConsoleOutputA
EnumSystemLanguageGroupsW
CreateFileMappingW
InitializeCriticalSection
SetCurrentDirectoryW
GetEnvironmentVariableA
EnumerateLocalComputerNamesA
GetCalendarInfoA
LocalReAlloc
UnmapViewOfFile
CreateHardLinkW
ActivateActCtx
SetThreadContext
PrivMoveFileIdentityW
WriteProcessMemory
CallNamedPipeA
GetThreadPriority
EnumResourceTypesA
IsValidCodePage
GetNumberFormatA
GlobalFindAtomA
InterlockedDecrement
lstrcmpi
LoadLibraryA
Module32Next
SetComputerNameW
CreateJobSet
ConvertThreadToFiber
GetNativeSystemInfo
GetStartupInfoA
DnsHostnameToComputerNameW
VirtualAlloc
GetSystemWow64DirectoryA
GetProcessPriorityBoost
SetTermsrvAppInstallMode

psapi

GetDeviceDriverFileNameW
InitializeProcessForWsWatch
GetModuleFileNameExW
QueryWorkingSet
GetMappedFileNameA
GetProcessImageFileNameW
GetMappedFileNameW
EnumPageFilesA
EnumProcesses
EnumDeviceDrivers
GetModuleInformation
GetProcessImageFileNameA
EnumPageFilesW
GetPerformanceInfo
EmptyWorkingSet
GetProcessMemoryInfo
GetDeviceDriverBaseNameA
GetWsChanges
GetModuleFileNameExA
GetDeviceDriverBaseNameW
GetModuleBaseNameA
GetDeviceDriverFileNameA
EnumProcessModules
GetModuleBaseNameW

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

987a4bd734f7bbbbf336938fcd50ef4c

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

iphlpapi

ntprint

msvcrt40

kernel32

psapi

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 237KB - Virtual size: 237KB

.data Size: 26KB - Virtual size: 469KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 237KB - Virtual size: 237KB

.data
Size: 26KB - Virtual size: 469KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 1024B - Virtual size: 1024B