da79b4b7beba59d1902fb076d06d486d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

da79b4b7beba59d1902fb076d06d486d_JaffaCakes118
Size

184KB
MD5

da79b4b7beba59d1902fb076d06d486d
SHA1

ab427856421d0972f1cd3c22a2e86d0a51b904a1
SHA256

53235f0ad7157b4f726e439aa803e0d7f59bf1c417a24f9b614846233b8c3d7a
SHA512

4b0f99854fcb595308daabe8a47f660fdb8f455dd79254b21857be0cfe3012a53e27652e522bd1dacd031b2e5605bb7aaeb5987879de88df3ed668786e9b84de
SSDEEP

3072:SDKPGwGinVvRJRp2QfRwZWT4LDXXpfFxKgO4miDFZKQ83FjNvtlOd+9BI2:YKPGwjVvRJRp2gwZWT4RDDF8VjAd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da79b4b7beba59d1902fb076d06d486d_JaffaCakes118

Files

da79b4b7beba59d1902fb076d06d486d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

826d1f08095109f06153d8e26e792c27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Works\KernelBots_Up16\Shell\Release\Shell.pdb

Imports

ws2_32

inet_ntoa
WSACleanup
setsockopt
htonl
closesocket
select
gethostname
sendto
WSAStartup
send
socket
inet_addr
htons
connect
gethostbyname

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

kernel32

HeapAlloc
VirtualProtect
HeapFree
Sleep
lstrlenW
CreateThread
lstrcpyW
WideCharToMultiByte
GetTickCount
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
InitializeCriticalSection
DeleteCriticalSection
lstrcatW
GetProcAddress
GetModuleHandleW
GlobalFree
GlobalAlloc
CreateFileW
GetModuleFileNameW
GetModuleFileNameA
GetSystemDirectoryW
OpenFile
CloseHandle
GetLastError
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
CreateProcessW
CopyFileW
DeleteFileW
LoadLibraryW
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileW
SetCurrentDirectoryW
GetPrivateProfileStringW
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
GetExitCodeThread
WaitForSingleObject
VirtualFree
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
TerminateProcess
GetCurrentThreadId
SetFilePointer
ReadFile
DuplicateHandle
ExitProcess
RtlUnwind
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
VirtualQuery
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
GetOEMCP
SetStdHandle
FlushFileBuffers
GetSystemInfo
SetEndOfFile
HeapCreate

user32

UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
wsprintfW
GetMessageW
TranslateMessage
DefWindowProcW
PostQuitMessage
SetWindowLongW
GetClientRect
GetWindowLongW
DispatchMessageW

advapi32

CloseServiceHandle
OpenServiceW
OpenSCManagerW
ChangeServiceConfigW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteValueW
CreateServiceW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyW

ole32

CoGetClassObject
OleSetContainedObject
OleInitialize

oleaut32

VariantClear
SysAllocString
VariantInit

shlwapi

PathRemoveFileSpecW

psapi

GetModuleFileNameExW
GetModuleBaseNameW

Exports

Exports

DestoryAntiVirus
GetDllModuleControlInit
StartShell
StartShell_A
StartShell_B
StartShell_C
StartShell_D

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shell__
Size: 4KB - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

826d1f08095109f06153d8e26e792c27

Headers

File Characteristics

PDB Paths

Imports

ws2_32

wininet

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

psapi

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 40KB - Virtual size: 86KB

.Shell__ Size: 4KB - Virtual size: 520B

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 40KB - Virtual size: 86KB

.Shell__
Size: 4KB - Virtual size: 520B

.reloc
Size: 12KB - Virtual size: 10KB