dd29e43a0c5972dc23a4e8a1436bdc0b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dd29e43a0c5972dc23a4e8a1436bdc0b_JaffaCakes118
Size

40KB
MD5

dd29e43a0c5972dc23a4e8a1436bdc0b
SHA1

42ded809d96681349580d2d06d94742413a968d6
SHA256

25b893b815bdf0ec5093364e0d921a30c9169b27cfb31802b43469028c59c2af
SHA512

367c96ef8fcda2abf40f4f27f02797bc2ec2e6521bb35e0c2c774f62c439053216aaa9747419f79b65c90ad7a6a53cab97249db18719b26332197fac8e504acb
SSDEEP

768:cBUMAnjmbj8M2kOGT3r2JkP5PalrSKZnue+ZQUBnK/mEPWzycSzs3d:cyMAjmbYM2dGm8ilrPueyKhp9zs3d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd29e43a0c5972dc23a4e8a1436bdc0b_JaffaCakes118

Files

dd29e43a0c5972dc23a4e8a1436bdc0b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cc0e6d9063b6e36f256a97ba4468cd27

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CreateStreamOnHGlobal
CoTaskMemFree

kernel32

WideCharToMultiByte
WriteFile
lstrcatA
MoveFileA
lstrcmpiA
WaitForSingleObject
TerminateThread
lstrlenA
lstrlenW
MapViewOfFile
UnmapViewOfFile
lstrcpyA
LocalFree
LocalAlloc
LoadLibraryA
Sleep
SetFilePointer
RtlMoveMemory
RemoveDirectoryA
ReadFile
Process32Next
Process32First
OpenProcess
lstrcpynA
MultiByteToWideChar
GlobalUnlock
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExitThread
ExitProcess
DeleteFileA
CreateToolhelp32Snapshot
CreateThread
CreateProcessA
CreatePipe
CreateFileMappingA
CreateFileA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
lstrcmpA

user32

wsprintfA
ReleaseDC
GetDC
ExitWindowsEx
WaitForInputIdle

advapi32

RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegCreateKeyA
RegCloseKey
GetUserNameA
RegSetValueExA

shlwapi

StrStrIA
StrRChrA
StrCmpNA
StrChrA

shell32

ShellExecuteA

wsock32

inet_addr
htons
htonl
getsockname
gethostname
gethostbyname
connect
closesocket
bind
select
__WSAFDIsSet
WSAStartup
WSACleanup
accept
send
shutdown
socket
listen
recv

ws2_32

WSAIoctl

rasapi32

RasEnumEntriesA
RasGetEntryDialParamsA
RasGetEntryPropertiesA

gdi32

GetDeviceCaps

urlmon

URLDownloadToFileA

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cool
Size: 130B - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cc0e6d9063b6e36f256a97ba4468cd27

Headers

File Characteristics

Imports

ole32

kernel32

user32

advapi32

shlwapi

shell32

wsock32

ws2_32

rasapi32

gdi32

urlmon

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 187KB

cool Size: 130B - Virtual size: 56KB

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 187KB

cool
Size: 130B - Virtual size: 56KB