b77e0b15907ace0989ee75570a6cd128_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b77e0b15907ace0989ee75570a6cd128_JaffaCakes118
Size

44KB
MD5

b77e0b15907ace0989ee75570a6cd128
SHA1

b49cb4e2ad038c2912ee6b1a9531665574619f50
SHA256

a9f09e2f1a467aca3a348c2654649c4f587436c7634e24e3d4e421dd0d1669e1
SHA512

810342bff79eea0bf6174207ab624efc077e3a2ecca528a7ab06d8794b6e903b6b21ae604f6d0b6eb6a800aafff66829a11bfcee7886419765cdfe1445cca820
SSDEEP

768:zgJ8UUtcV9v/9Mr/ReDE3bVPfhU5zt4gy0tFTLxpvrgQhjDLUb/dWvwSOeTBpP/i:VZuLv/9igW3U5n/rEyjv2Spn/i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b77e0b15907ace0989ee75570a6cd128_JaffaCakes118

Files

b77e0b15907ace0989ee75570a6cd128_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
recv
WSACleanup
WSAGetLastError
closesocket
WSAStartup
socket
connect

kernel32

GetCommandLineA
GetStartupInfoA
Process32First
Process32Next
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
SetPriorityClass
GetCurrentProcess
ExitProcess
CloseHandle
CreateMutexA
lstrcpyA
lstrcatA
lstrlenA
CreateEventA
GetModuleFileNameA
GetWindowsDirectoryA
GetCurrentThreadId
ResumeThread
CreateThread
DeleteFileA
GlobalMemoryStatus
GetCurrentProcessId
HeapAlloc
GetProcessHeap
TerminateProcess
WriteProcessMemory
GetThreadContext
ReadProcessMemory
GetModuleHandleA

user32

DispatchMessageA
TranslateMessage
SendMessageA
ShowWindow
CreateWindowExA
RegisterClassA
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
DefWindowProcA
ExitWindowsEx
UpdateWindow

advapi32

RegSetValueExA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

ntdll

RtlUnwind
ZwUnmapViewOfSection
sprintf
strcspn
strncpy
atoi
strstr
_strlwr
_itoa
_strupr

msvcirt

??_Dofstream@@QAEXXZ
??_Difstream@@QAEXXZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?close@ifstream@@QAEXXZ
?write@ostream@@QAEAAV1@PBDH@Z
?read@istream@@QAEAAV1@PADH@Z
?open@ofstream@@QAEXPBDHH@Z
??0ofstream@@QAE@XZ
?open@ifstream@@QAEXPBDHH@Z
?openprot@filebuf@@2HB
??0ifstream@@QAE@XZ

msvcrt

printf
__CxxFrameHandler
malloc

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

ntdll

msvcirt

msvcrt

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 6KB

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 6KB