b9ef0fa355c6dfc5b186ad13220e15c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b9ef0fa355c6dfc5b186ad13220e15c7_JaffaCakes118
Size

615KB
MD5

b9ef0fa355c6dfc5b186ad13220e15c7
SHA1

efa978f577141c563dbfde2708e7b9e2b6f6e6f6
SHA256

c4e777a443e270da59b5fe0f7a8353af372502937a8326974c503af42de862c6
SHA512

df798d94e73817ead3c5f1dfea1cc4e3dcc85a90e74ce4abeb37225c667ade53dea2a5a8b765282fc4e45d308c07af75050dadb0c977dff00a5eeb6dd231d9dc
SSDEEP

12288:aXdItMxgNmQhtQfTQiBnNghBGXm2lA/5G4WWqqV/IPi0hTXOR:aXdM0zfTfNYElA/5/wqVi70

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9ef0fa355c6dfc5b186ad13220e15c7_JaffaCakes118

Files

b9ef0fa355c6dfc5b186ad13220e15c7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a6be6dd08afd8b84d02399d112785246

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Intel\Desktop\SYM-VNC-NETAP__304_-ASN.PIABOT\Debug\h1dd3n.pdb

Imports

kernel32

ExitProcess
CloseHandle
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
Sleep
CreateThread
DeleteFileA
OpenProcess
GetCurrentProcessId
GetLastError
CopyFileA
SetFileAttributesA
GetFileAttributesA
GetModuleHandleA
WaitForSingleObject
CreateMutexA
GetTickCount
TerminateThread
GetTempPathA
MoveFileA
LoadLibraryA
GetProcAddress
GetComputerNameA
GetLocaleInfoA
GetVersionExA
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
CreateEventA
ReadFile
CreateFileA
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
MultiByteToWideChar
lstrcmpiA
GetExitCodeProcess
PeekNamedPipe
GetLogicalDrives
GlobalMemoryStatus
SetEnvironmentVariableA
CompareStringW
CompareStringA
VirtualQuery
GetTimeZoneInformation
lstrlenA
SetEndOfFile
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSection
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
VirtualAlloc
HeapReAlloc
HeapSize
LoadLibraryW
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
DebugBreak
VirtualFree
HeapCreate
HeapDestroy
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
HeapValidate
IsBadReadPtr
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetCurrentThread
GetStdHandle
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
FatalAppExitA
InterlockedExchange
SetHandleCount
GetFileType
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW

mpr

WNetAddConnection2A

ws2_32

getsockopt
ntohs
inet_ntoa
WSACleanup
WSAStartup
setsockopt
ioctlsocket
bind
WSASocketA
accept
gethostbyname
inet_addr
htons
recv
closesocket
socket
send
select
__WSAFDIsSet
getsockname
listen
connect

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 664KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6be6dd08afd8b84d02399d112785246

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

mpr

ws2_32

version

Sections

.text Size: 464KB - Virtual size: 463KB

.rdata Size: 124KB - Virtual size: 124KB

.data Size: 25KB - Virtual size: 664KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 464KB - Virtual size: 463KB

.rdata
Size: 124KB - Virtual size: 124KB

.data
Size: 25KB - Virtual size: 664KB

.rsrc
Size: 512B - Virtual size: 436B