ba7793845fe2a02187263a96e8daaec6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ba7793845fe2a02187263a96e8daaec6_JaffaCakes118
Size

30KB
MD5

ba7793845fe2a02187263a96e8daaec6
SHA1

822e68fed08991f131d345f4891bca9de923fd44
SHA256

21d58245c495b9ed4234577fa3fb43cd4c703f38a9b5ce83aa490613168a735f
SHA512

cca23b2a95432fafc2e9a659e3d53e2b9364fbb1d27f01d05d061150d9b5b4692027bd321c947ec6e32ec70dade66570828fe7b760068d501cd43d24b7f9474a
SSDEEP

384:1HPQGQUUylFJ6sNldMKAnw39x/h6h8KrEU8IQGrEU8Ih1Wv8A4W:GSlX65nw/p66nTD6fA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba7793845fe2a02187263a96e8daaec6_JaffaCakes118

Files

ba7793845fe2a02187263a96e8daaec6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

429b30c11e07cb6e982219023ae17ad7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord825

msvcrt

srand
atoi
rand
strstr
__CxxFrameHandler
fprintf
fseek
ftell
rewind
malloc
time
_stricmp
free
sprintf
strncpy
fgetc
fopen
fread
fwrite
fputc
fclose
atol
memmove
strchr
fgets
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strlwr
_strnicmp

kernel32

WinExec
CreateThread
FindFirstFileA
FindNextFileA
GetTempPathA
CreateProcessA
WaitForSingleObject
TerminateProcess
Sleep
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GetLastError
DeleteFileA
GetComputerNameA
CreateToolhelp32Snapshot
Process32First
Process32Next

user32

ExitWindowsEx

advapi32

OpenProcessToken
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA

shell32

SHGetSpecialFolderPathA

msvcirt

?endl@@YAAAVostream@@AAV1@@Z
?cout@@3Vostream_withassign@@A
??6ostream@@QAEAAV0@PBD@Z

wsock32

gethostbyname
WSAStartup
inet_addr

psapi

GetModuleFileNameExA
EnumProcessModules

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

wininet

InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionA
InternetQueryOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetCrackUrlA

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

429b30c11e07cb6e982219023ae17ad7

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

msvcirt

wsock32

psapi

msvcp60

wininet

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 8KB - Virtual size: 104KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 8KB - Virtual size: 104KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 2KB - Virtual size: 1KB