c90aefe8e4d7750561b4b2d5d4c9c0d5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c90aefe8e4d7750561b4b2d5d4c9c0d5_JaffaCakes118
Size

61KB
MD5

c90aefe8e4d7750561b4b2d5d4c9c0d5
SHA1

eaff94add917f0350f1f39ac9c0bae1d3bed2d94
SHA256

ec2fec8d49965294ff9008543ee0938d9c121d025d226b00ea076dc4ecbbac33
SHA512

010ee7841f815cf194c6fe6b972df9064d313244e0a8c7b5702ebfb6d34ff1b71d64424f6bfb562e0d2e1cca35df1ff4f2de797c351bd56e48faecfad915b5f8
SSDEEP

1536:hxivxV8NWfb8nO+GYzasU9aD/pGMWNfU7WEmu8RzrPj:hEoM8ZU9aDcMWNfU75z8Rzr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c90aefe8e4d7750561b4b2d5d4c9c0d5_JaffaCakes118

Files

c90aefe8e4d7750561b4b2d5d4c9c0d5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

df3b97187e808724db41f22a316b6db5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

isgraph
strcspn
atoi
memcpy
memmove
strlen
memchr
isalpha
_vsnprintf
strstr
memset
strcmp
_allshl

kernel32

GetPrivateProfileIntW
WideCharToMultiByte
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
GetCurrentProcess
lstrcatW
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcmpiW
LocalFree
lstrcmpA
GetPrivateProfileIntA
GetVolumeInformationA
GetSystemDirectoryA
GetLastError
DeviceIoControl
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
FindFirstFileA
LocalAlloc
LocalReAlloc
lstrcpynW
Sleep
CreateProcessA
GetVersion
GetSystemTime
DeleteFileA
CreateThread
GetTickCount
TerminateThread
ExitThread
GetCurrentThreadId
lstrcmpiA
Process32First
GetLogicalDrives
GetDriveTypeA
OpenProcess
Process32Next
CreateToolhelp32Snapshot
GetDiskFreeSpaceExA
WaitForSingleObject
GetExitCodeThread
GetModuleFileNameA
SetFilePointer
SetEvent
InitializeCriticalSection
FindNextFileA
LeaveCriticalSection
CreateDirectoryA
EnterCriticalSection
SetFileAttributesA
ResetEvent
GetTimeFormatA
GetDateFormatA
FindClose
ExpandEnvironmentStringsA
GetFileAttributesA
GetPrivateProfileStringA
lstrcmpW
lstrcpynA
lstrcpyA
lstrcatA
CreateFileA
GetFileSize
ReadFile
CloseHandle
lstrlenA
MultiByteToWideChar
lstrcpyW
lstrlenW
GetSystemTimeAsFileTime
CreateEventA

user32

wsprintfA
wsprintfW

advapi32

CryptCreateHash
RegDeleteValueA
RegEnumValueA
RegFlushKey
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
RegCreateKeyExA
RevertToSelf
DuplicateTokenEx
ImpersonateSelf
SetThreadToken
CryptGetHashParam
CryptDestroyHash
RegQueryValueExW
RegSetValueExA
RegEnumKeyA
RegLoadKeyA
RegUnLoadKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptReleaseContext
CryptAcquireContextA
RegDeleteKeyA
RegCreateKeyA
CryptHashData

wininet

InternetOpenA
FtpPutFileA
InternetReadFile
InternetConnectA
InternetOpenUrlA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetCloseHandle

ws2_32

accept
listen
__WSAFDIsSet
bind
WSAGetLastError
select
recvfrom
ntohs
WSAStartup
getsockname
send
gethostbyname
closesocket
socket
recv
htons
inet_addr
inet_ntoa
connect
sendto
ioctlsocket
setsockopt

ole32

CoTaskMemFree

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df3b97187e808724db41f22a316b6db5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

wininet

ws2_32

ole32

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 2KB - Virtual size: 86KB

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 2KB - Virtual size: 86KB