df17760ca0a4a2132dbd9fafe8aa83bd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df17760ca0a4a2132dbd9fafe8aa83bd_JaffaCakes118
Size

64KB
MD5

df17760ca0a4a2132dbd9fafe8aa83bd
SHA1

616246b4d4ae70e97b1225503f5ab2428fd542f5
SHA256

f264fd3282a27887f981f438a9ad9a950009fdb29da50bf65202f151a839bb87
SHA512

f76f0c23faed1faddf3378b1c2799160c385cbcb5458d648770a758252a64b6e329aca7759b0398398ae6430d2df077a84029b21010864cc7f38498424f1310c
SSDEEP

1536:lo84/XndYVTCLbDz7dgNTC+yckcXq4RVMmwIZsXB1xE4:lo84/XndYVTCL3qvIsakZs/xE4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df17760ca0a4a2132dbd9fafe8aa83bd_JaffaCakes118

Files

df17760ca0a4a2132dbd9fafe8aa83bd_JaffaCakes118
.dll .vbs windows:4 windows x86 arch:x86 polyglot

05e2544fea612da8afae8baaf45a2f36

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
HeapAlloc
GetProcessHeap
OpenProcess
TerminateProcess
Sleep
WriteFile
CreateFileA
CreateProcessA
GetSystemDirectoryA
OutputDebugStringA
ReadFile
GetFileSize
SetFilePointer
GetComputerNameA
CreateToolhelp32Snapshot
DeleteFileA
CompareFileTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
PeekNamedPipe
WaitForSingleObject
SetHandleInformation
CreatePipe
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
CreateDirectoryA
SetEnvironmentVariableA
CompareStringW
GetLastError
Process32First
CloseHandle
Process32Next
GetLogicalDriveStringsA
GetDriveTypeA
GetTempPathA
CreateThread
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
RtlUnwind
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetTimeZoneInformation
GetLocalTime
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA

user32

CharUpperA

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
OpenProcessToken
GetTokenInformation
LookupAccountSidA
GetUserNameA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysFreeString

wininet

InternetReadFile
InternetSetOptionA
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
InternetCloseHandle
InternetConnectA
InternetOpenA
HttpOpenRequestA

ws2_32

recv
bind
WSAIoctl
htons
socket
gethostname
gethostbyname
WSAStartup
WSAGetLastError

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05e2544fea612da8afae8baaf45a2f36

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

wininet

ws2_32

iphlpapi

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 3KB