dd51ef12cea9bb6da4e9ed296f93f701_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dd51ef12cea9bb6da4e9ed296f93f701_JaffaCakes118
Size

1.8MB
MD5

dd51ef12cea9bb6da4e9ed296f93f701
SHA1

c24341bdeed9b1003d9e05e7edf5a13d96c8758a
SHA256

37a6ff7ba0e8b6e2181d689810e37cbeb2016fb4b0feca06f14cf591a5bd688a
SHA512

54398ba00357766b3f5c7d4b2a356e91638835abbb3f4e2e811a738fe892ec1e93e8551b5da78bbfb7c34bb7f4c2bc4a8f8a0d2c893ab81af7080c3001de2d95
SSDEEP

49152:ZZrC4FyeXVdceAPVF0ff91VbYjZddrV7tIhJ:ZtC4VncjPVF0ffHZYNddrV7s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd51ef12cea9bb6da4e9ed296f93f701_JaffaCakes118

Files

dd51ef12cea9bb6da4e9ed296f93f701_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cd39ca8eaad99e81d8a48c401acf2a84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
GetUserNameW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptStringToBinaryA

iphlpapi

GetAdaptersAddresses

kernel32

AddVectoredExceptionHandler
AreFileApisANSI
AssignProcessToJobObject
CancelIo
CloseHandle
ConnectNamedPipe
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexA
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleTitleW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceW
GetEnvironmentStrings
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocalTime
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNamedPipeHandleStateA
GetNumberOfConsoleInputEvents
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalFree
LockFile
LockFileEx
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PeekNamedPipe
PostQueuedCompletionStatus
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReadConsoleInputW
ReadConsoleW
ReadDirectoryChangesW
ReadFile
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointer
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SuspendThread
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnregisterWait
UnregisterWaitEx
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WideCharToMultiByte
WriteConsoleInputW
WriteConsoleW
WriteFile
lstrlenW

msvcrt

__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_close
_endthreadex
_errno
_fdopen
_fmode
_get_osfhandle
_initterm
_iob
_lock
_lseeki64
_onexit
_open_osfhandle
_pclose
_popen
_read
_setjmp3
_snwprintf
time
gmtime
_strnicmp
_sys_nerr
_ultoa
_unlock
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fread
free
freopen
frexp
fseek
ftell
fwrite
getc
getenv
gmtime
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
isxdigit
localeconv
localtime
log10
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
mktime
perror
printf
putchar
puts
qsort
rand
realloc
remove
rename
setlocale
setvbuf
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
_vsnprintf
_wchmod
_wcsnicmp
_wmkdir
_write
_wrmdir
abort
acos
asin
system
tan
time
tmpfile
tmpnam
tolower
toupper
ungetc
vfprintf
wcschr
wcscpy
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcstombs
atoi
_stati64
longjmp
_write
_wcsrev
_wcsdup
_umask
_strdup
_read
_open
_memccpy
_getpid
_fileno
_close
_access

psapi

GetProcessMemoryInfo

user32

MapVirtualKeyW

userenv

GetUserProfileDirectoryW

ws2_32

FreeAddrInfoW
GetAddrInfoW
GetNameInfoW
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASetLastError
WSASocketW
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
setsockopt
shutdown
socket

Exports

Exports

luaopen_lcurl
luaopen_lcurl_safe
luaopen_luv
luv_loop
luv_set_thread_cb
luv_state
unqlite_array_add_elem
unqlite_array_add_strkey_elem
unqlite_array_count
unqlite_array_fetch
unqlite_array_walk
unqlite_begin
unqlite_close
unqlite_commit
unqlite_compile
unqlite_compile_file
unqlite_config
unqlite_context_alloc_chunk
unqlite_context_free_chunk
unqlite_context_new_array
unqlite_context_new_scalar
unqlite_context_output
unqlite_context_output_format
unqlite_context_peek_aux_data
unqlite_context_push_aux_data
unqlite_context_random_num
unqlite_context_random_string
unqlite_context_realloc_chunk
unqlite_context_release_value
unqlite_context_result_buf_length
unqlite_context_throw_error
unqlite_context_throw_error_format
unqlite_context_user_data
unqlite_create_constant
unqlite_create_function
unqlite_delete_constant
unqlite_delete_function
unqlite_function_name
unqlite_kv_append
unqlite_kv_append_fmt
unqlite_kv_config
unqlite_kv_cursor_data
unqlite_kv_cursor_data_callback
unqlite_kv_cursor_delete_entry
unqlite_kv_cursor_first_entry
unqlite_kv_cursor_init
unqlite_kv_cursor_key
unqlite_kv_cursor_key_callback
unqlite_kv_cursor_last_entry
unqlite_kv_cursor_next_entry
unqlite_kv_cursor_prev_entry
unqlite_kv_cursor_release
unqlite_kv_cursor_reset
unqlite_kv_cursor_seek
unqlite_kv_cursor_valid_entry
unqlite_kv_delete
unqlite_kv_fetch
unqlite_kv_fetch_callback
unqlite_kv_store
unqlite_kv_store_fmt
unqlite_lib_config
unqlite_lib_copyright
unqlite_lib_ident
unqlite_lib_init
unqlite_lib_is_threadsafe
unqlite_lib_shutdown
unqlite_lib_signature
unqlite_lib_version
unqlite_open
unqlite_result_bool
unqlite_result_double
unqlite_result_int
unqlite_result_int64
unqlite_result_null
unqlite_result_resource
unqlite_result_string
unqlite_result_string_format
unqlite_result_value
unqlite_rollback
unqlite_util_load_mmaped_file
unqlite_util_random_num
unqlite_util_random_string
unqlite_util_release_mmaped_file
unqlite_value_bool
unqlite_value_compare
unqlite_value_double
unqlite_value_int
unqlite_value_int64
unqlite_value_is_bool
unqlite_value_is_callable
unqlite_value_is_empty
unqlite_value_is_float
unqlite_value_is_int
unqlite_value_is_json_array
unqlite_value_is_json_object
unqlite_value_is_null
unqlite_value_is_numeric
unqlite_value_is_resource
unqlite_value_is_scalar
unqlite_value_is_string
unqlite_value_null
unqlite_value_release
unqlite_value_reset_string_cursor
unqlite_value_resource
unqlite_value_string
unqlite_value_string_format
unqlite_value_to_bool
unqlite_value_to_double
unqlite_value_to_int
unqlite_value_to_int64
unqlite_value_to_resource
unqlite_value_to_string
unqlite_vm_config
unqlite_vm_dump
unqlite_vm_exec
unqlite_vm_extract_variable
unqlite_vm_new_array
unqlite_vm_new_scalar
unqlite_vm_release
unqlite_vm_release_value
unqlite_vm_reset

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd39ca8eaad99e81d8a48c401acf2a84

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

iphlpapi

kernel32

msvcrt

psapi

user32

userenv

ws2_32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 3KB - Virtual size: 3KB

.rdata Size: 290KB - Virtual size: 290KB

.bss Size: - Virtual size: 21KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 11KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 56B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 45KB - Virtual size: 45KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 3KB - Virtual size: 3KB

.rdata
Size: 290KB - Virtual size: 290KB

.bss
Size: - Virtual size: 21KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 11KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 45KB - Virtual size: 45KB