c7cd9a47a60230368ce59cca6d045b1c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c7cd9a47a60230368ce59cca6d045b1c_JaffaCakes118
Size

44KB
MD5

c7cd9a47a60230368ce59cca6d045b1c
SHA1

9298b6b58ef084304aad3cec9a5a7d3cfbf36c72
SHA256

446e307a94f8961ea648edb78de3ebda96c09d532c4d17a6168a8366532db955
SHA512

375ff4ba1396d29e6328bb1b1fcd33e031939b66614556ec8cb9bb4b669810e053040c4d265870da9052ac9f561bfd145dff1f0f2f04ecfac9953fba269512ac
SSDEEP

768:zgJ8UUtcV9v/9Mr/ReDE3bVPfhU5zt4gy0tFTLxpvrgQhjDLUb/dWvwSOeTBpP/4:VZuLv/9igW3U5n/rEyjv2Spn/4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7cd9a47a60230368ce59cca6d045b1c_JaffaCakes118

Files

c7cd9a47a60230368ce59cca6d045b1c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
recv
WSACleanup
WSAGetLastError
closesocket
WSAStartup
socket
connect

kernel32

GetCommandLineA
GetStartupInfoA
Process32First
Process32Next
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
SetPriorityClass
GetCurrentProcess
ExitProcess
CloseHandle
CreateMutexA
lstrcpyA
lstrcatA
lstrlenA
CreateEventA
GetModuleFileNameA
GetWindowsDirectoryA
GetCurrentThreadId
ResumeThread
CreateThread
DeleteFileA
GlobalMemoryStatus
GetCurrentProcessId
HeapAlloc
GetProcessHeap
TerminateProcess
WriteProcessMemory
GetThreadContext
ReadProcessMemory
GetModuleHandleA

user32

DispatchMessageA
TranslateMessage
SendMessageA
ShowWindow
CreateWindowExA
RegisterClassA
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
DefWindowProcA
ExitWindowsEx
UpdateWindow

advapi32

RegSetValueExA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

ntdll

RtlUnwind
ZwUnmapViewOfSection
sprintf
strcspn
strncpy
atoi
strstr
_strlwr
_itoa
_strupr

msvcirt

??_Dofstream@@QAEXXZ
??_Difstream@@QAEXXZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?close@ifstream@@QAEXXZ
?write@ostream@@QAEAAV1@PBDH@Z
?read@istream@@QAEAAV1@PADH@Z
?open@ofstream@@QAEXPBDHH@Z
??0ofstream@@QAE@XZ
?open@ifstream@@QAEXPBDHH@Z
?openprot@filebuf@@2HB
??0ifstream@@QAE@XZ

msvcrt

printf
__CxxFrameHandler
malloc

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

ntdll

msvcirt

msvcrt

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 6KB

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 6KB