c2a360b32743ae0b0b64a24c1e5eea9a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c2a360b32743ae0b0b64a24c1e5eea9a_JaffaCakes118
Size

56KB
MD5

c2a360b32743ae0b0b64a24c1e5eea9a
SHA1

60cda5a2624f8bb6d24d717b9ae5e3e99a0e2db8
SHA256

a51bd8bd1974c0ef0188a7fddba84a17d08daca32d4ff60c10f57cafcdf32318
SHA512

c118b19e05553597cb28c6a745349c7bcd412f0d1f0937aea48efedf9117fe89155d64709927ca7f9cb5290fb269de1f8f9c4401b9d573da191db1f28039efc4
SSDEEP

768:ffEQBESUJIC0wWGbas15Y2RrvzxGyG5ZNJB4DZPZs+kEhhjrBDRMNY+JyVd:XEQSpJewdbPfx4DJBCBBhhjrBDRMq+AT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2a360b32743ae0b0b64a24c1e5eea9a_JaffaCakes118

Files

c2a360b32743ae0b0b64a24c1e5eea9a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b39e0e55d94ef546414be2e8596950c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
ntohs
WSAGetLastError
WSAStartup
WSACleanup
gethostbyaddr
inet_ntoa
inet_addr

iphlpapi

SendARP

kernel32

lstrlenW
lstrlenA
SetEvent
SystemTimeToFileTime
GetLocalTime
CreateEventA
WaitForSingleObject
GetExitCodeThread
WaitForMultipleObjects
Sleep
FreeLibrary
LoadLibraryA
OpenMutexA
GetCurrentThreadId
GetModuleFileNameA
CreateSemaphoreA
OpenEventA
OpenSemaphoreA
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
GetTickCount
QueryPerformanceCounter
ExitProcess
FindResourceA
LoadResource
InitializeCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentProcessId
GetLastError
GetProcessHeap
CreateMutexA
LoadLibraryW
GetProcAddress

advapi32

CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
CryptDeriveKey
CryptGetHashParam

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantInit
VarBstrCmp
SysStringLen
SysFreeString
SysAllocString
VariantClear

samlib

SamiSetDSRMPassword
SamEnumerateAliasesInDomain
SamQueryInformationUser
SamLookupIdsInDomain
SamOpenAlias
SamiLmChangePasswordUser
SamRemoveMultipleMembersFromAlias
SamiEncryptPasswords
SamTestPrivateFunctionsDomain
SamAddMemberToGroup
SamiChangeKeys
SamChangePasswordUser2
SamRidToSid

snmpapi

SnmpUtilOctetsFree
SnmpUtilPrintOid
SnmpUtilOidNCmp
SnmpTfxClose

Sections

.edata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 8KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b39e0e55d94ef546414be2e8596950c

Headers

File Characteristics

Imports

ws2_32

iphlpapi

kernel32

advapi32

ole32

oleaut32

samlib

snmpapi

Sections

.edata Size: 10KB - Virtual size: 9KB

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 48KB

.edata Size: 8KB - Virtual size: 59KB

.data Size: 6KB - Virtual size: 361KB

.edata Size: 10KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.edata
Size: 10KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 48KB

.edata
Size: 8KB - Virtual size: 59KB

.data
Size: 6KB - Virtual size: 361KB

.edata
Size: 10KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB