d44d9594c21eab54cfb6c87507b86c12_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d44d9594c21eab54cfb6c87507b86c12_JaffaCakes118
Size

88KB
MD5

d44d9594c21eab54cfb6c87507b86c12
SHA1

b39da76a58274affaff9ce5e7b7f66d7cf672b7e
SHA256

1db025e538b143f49b41b410a7a7ffe90331e5e9e2d433af92ff5437af11eca1
SHA512

35902b78a63313053afec767c2ed85b0ed5fca19d2dba1b0f965c9be1dc8fdf81b581290442feeb2459ea8ac5bd6500e74868f2dd990e6e9f86b07ce9586190a
SSDEEP

1536:Nd2yRL5DdEOy9XevU2Smi9BXz2+BiILsX4iAJ84/zIp8QCtdSTPCyT2QV7:DDdz0OsLmGAOW4JegzIfCCTay1d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d44d9594c21eab54cfb6c87507b86c12_JaffaCakes118

Files

d44d9594c21eab54cfb6c87507b86c12_JaffaCakes118
.exe windows:5 windows x86 arch:x86

62611f81e1769fb275f157c09de79175

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetConsoleInputExeNameW
HeapLock
GetGeoInfoA
SetTermsrvAppInstallMode
SetConsoleHardwareState
LZClose
GetNumberFormatA
GetPrivateProfileSectionA
UnlockFileEx
LoadLibraryA
VirtualAlloc
CallNamedPipeA
FindFirstChangeNotificationA
GetComputerNameExA
Module32FirstW
GetConsoleSelectionInfo
CreateDirectoryExW
LocalShrink

msvcp60

??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
?_Index@ios_base@std@@0HA
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDF@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Doraise@overflow_error@std@@MBEXXZ
?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAGH@Z
?quiet_NaN@?$numeric_limits@I@std@@SAIXZ
?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBEHXZ
??8std@@YA_NABNABV?$complex@N@0@@Z

expsrv

__vbaFpCDblR8
__vbaVarCopy
__vbaI2ForNextCheck
rtcLeftCharBstr
__vbaAryRebase1Var
TipUnloadProject
__vbaVarCmpLe
__vbaStrTextCmp
__vbaStrToUnicode
rtcSaveSetting
rtcFileLen
__vbaVarTstLe

mgmtapi

SnmpMgrStrToOid
SnmpMgrClose
SnmpMgrCtl
SnmpMgrOidToStr
SnmpMgrTrapListen
SnmpMgrOpen
SnmpMgrGetTrap
SnmpMgrRequest
SnmpMgrGetTrapEx

user32

SetScrollPos
BringWindowToTop

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62611f81e1769fb275f157c09de79175

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp60

expsrv

mgmtapi

user32

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 19KB - Virtual size: 39KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 220B

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 19KB - Virtual size: 39KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 220B