dc87748f64232f47b58b3b02fa1ed2ce_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dc87748f64232f47b58b3b02fa1ed2ce_JaffaCakes118
Size

175KB
MD5

dc87748f64232f47b58b3b02fa1ed2ce
SHA1

1a7ece2a39b72beba7730918f206e011a010d998
SHA256

3cfd3ef82878b250477799e97a89a5e2e4d6e245a6c889c3b239edd809551b32
SHA512

349e6842c8ed0f91496844fce35eeabac37dd85be66e38a52eb49bd8f6fec62da072861aeae60b2deb2b85273be8ad4217c3d41ff510044afc43c36661b7fe38
SSDEEP

3072:VM7jOaGXlei6ns1tMuA88hBsTNa32oVickYclgHbERGYzhoYsjWv0X8fIwUU3/eU:VM76pXgYtVA823iPYYgwQghpsjQIwUU3

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Packet32.dll
unpack003/Snowing/Release/Packet32.dll
unpack003/Snowing/Release/Snowing.exe

Files

dc87748f64232f47b58b3b02fa1ed2ce_JaffaCakes118
.rar
cvery.comnet/1CD13F0.txt
cvery.comnet/1CDA8F0.txt
cvery.comnet/Analyzer.gif
.gif
cvery.comnet/Analyzer.vbp
cvery.comnet/Analyzer.vbw
cvery.comnet/AnalyzerThread.bas
.vbs
cvery.comnet/FrmAbout.frm
cvery.comnet/FrmAbout.frx
cvery.comnet/FrmPacket.frm
.vbs
cvery.comnet/FrmPacket.frx
cvery.comnet/MSSCCPRJ.SCC
cvery.comnet/ModAnalyzer.bas
.vbs
cvery.comnet/ModProtohdr.bas
.vbs
cvery.comnet/NetSocket/Form1.frm
.vbs
cvery.comnet/NetSocket/Form1.frx
cvery.comnet/NetSocket/Form1.log
cvery.comnet/NetSocket/MSSCCPRJ.SCC
cvery.comnet/NetSocket/Module1.bas
.vbs
cvery.comnet/NetSocket/NetSock.vbp
cvery.comnet/NetSocket/NetSock.vbw
cvery.comnet/NetSocket/NetSockTest.vbp
cvery.comnet/NetSocket/NetSockTest.vbw
cvery.comnet/NetSocket/NetSocket.ctl
.vbs
cvery.comnet/NetSocket/NetSocket.ctx
cvery.comnet/NetSocket/zpacket.vxd
cvery.comnet/PacketBase.bas
cvery.comnet/Packet_ARP.bas
cvery.comnet/Packet_ICMP.bas
cvery.comnet/Packet_IGMP.bas
cvery.comnet/Packet_IP.bas
.vbs
cvery.comnet/Packet_TCP.bas
.vbs
cvery.comnet/Packet_UDP.bas
cvery.comnet/ReadMe1st.txt
cvery.comnet/dpsn.zip
.zip
DPSN.doc
.doc windows office2003
Dpsn.dpr
Dpsn.res
IngusPacket.pas
Ingusclass.pas
Packet32.dll
.dll windows:4 windows x86 arch:x86

6e7d99abf4354f963b9c71e024e2fa51

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
DeviceIoControl
CreateEventA
GlobalFree
ResetEvent
CloseHandle
GlobalUnlock
GetOverlappedResult
GlobalHandle
lstrcpyA
GlobalLock
GlobalAlloc

user32

wsprintfA

advapi32

RegEnumKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

Exports

Exports

PacketAdapterDesc
PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetAddress
PacketInitPacket
PacketOpenAdapter
PacketReceivePacket
PacketResetAdapter
PacketSendPacket
PacketSetFilter
PacketWaitPacket

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 453B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 570B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Packet32.pas
Protohdr.pas
uSnif.dfm
uSnif.pas
zpacket.vxd
cvery.comnet/snowing.zip
.zip
Packet32/DEVIOCTL.H
Packet32/NTDDNDIS.H
Packet32/Ntddpack.h
Packet32/PACKOFF.H
Packet32/PACKON.H
Packet32/Packet32.c
Packet32/Packet32.def
Packet32/Packet32.dsp
Packet32/Packet32.dsw
Packet32/Packet32.h
Packet32/Packet32.mak
Readme.txt
Snowing/Packet32.h
Snowing/Packet32.lib
Snowing/Protohdr.h
Snowing/Release/Packet32.dll
.dll windows:4 windows x86 arch:x86

6e7d99abf4354f963b9c71e024e2fa51

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
DeviceIoControl
CreateEventA
GlobalFree
ResetEvent
CloseHandle
GlobalUnlock
GetOverlappedResult
GlobalHandle
lstrcpyA
GlobalLock
GlobalAlloc

user32

wsprintfA

advapi32

RegEnumKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

Exports

Exports

PacketAdapterDesc
PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetAddress
PacketInitPacket
PacketOpenAdapter
PacketReceivePacket
PacketResetAdapter
PacketSendPacket
PacketSetFilter
PacketWaitPacket

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 453B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 570B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Snowing/Release/Snowing.exe
.exe windows:4 windows x86 arch:x86

0580d6e6212172616b8cfb4eaeefc075

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetHandleCount
lstrlenA
CloseHandle
CreateFileA
lstrcpyA
GetStartupInfoA
HeapAlloc
GetVersion
ReadFile
LoadLibraryA
GetProcAddress
GetStringTypeW
GetStringTypeA
VirtualAlloc
HeapFree
SetFilePointer
SetStdHandle
RtlUnwind
VirtualFree
GetLastError
SetConsoleCtrlHandler
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
HeapDestroy
FlushFileBuffers
WriteFile
GetStdHandle
GetFileType
FreeEnvironmentStringsW
HeapCreate
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP

user32

wsprintfA

packet32

PacketSetFilter
PacketGetAdapterNames
PacketOpenAdapter
PacketAdapterDesc
PacketGetAddress
PacketResetAdapter
PacketAllocatePacket
PacketCloseAdapter
PacketInitPacket
PacketReceivePacket
PacketFreePacket

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 951B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Snowing/Release/zpacket.vxd
Snowing/Snowing.dsp
Snowing/Snowing.dsw
Snowing/snowing.c
Zpacket/Makefile
Zpacket/ZNdis.c
Zpacket/ZNdis.h
Zpacket/ZPacket.c
Zpacket/ZPacket.def
Zpacket/ZPacket.h
Zpacket/ZStart.asm
Zpacket/ZUtil.c
Zpacket/ZUtil.h
Zpacket/ddknet32.bat
Zpacket/zpacket.vxd
cvery.comnet/zpacket.vxd
cvery.comnet/下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

6e7d99abf4354f963b9c71e024e2fa51

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 453B

.data Size: 512B - Virtual size: 104B

.idata Size: 1024B - Virtual size: 570B

.reloc Size: 512B - Virtual size: 200B

6e7d99abf4354f963b9c71e024e2fa51

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 453B

.data Size: 512B - Virtual size: 104B

.idata Size: 1024B - Virtual size: 570B

.reloc Size: 512B - Virtual size: 200B

0580d6e6212172616b8cfb4eaeefc075

Headers

File Characteristics

Imports

kernel32

user32

packet32

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 1024B - Virtual size: 951B

.data Size: 17KB - Virtual size: 22KB

.idata Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 453B

.data
Size: 512B - Virtual size: 104B

.idata
Size: 1024B - Virtual size: 570B

.reloc
Size: 512B - Virtual size: 200B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 453B

.data
Size: 512B - Virtual size: 104B

.idata
Size: 1024B - Virtual size: 570B

.reloc
Size: 512B - Virtual size: 200B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 1024B - Virtual size: 951B

.data
Size: 17KB - Virtual size: 22KB

.idata
Size: 1KB - Virtual size: 1KB