dd671afda9dfa794ab85bb26fa0d2005_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dd671afda9dfa794ab85bb26fa0d2005_JaffaCakes118
Size

25KB
MD5

dd671afda9dfa794ab85bb26fa0d2005
SHA1

a82cea5eb988446420aa8b1569d7640ed0786cc0
SHA256

ae22681a3ed29d6a9a855f222c3fc9f0531381e4760076f3f0428daae24cb0f4
SHA512

b0309345ec937094f21a30def4630ca17c4ffbba0733ad9f33d88d299938a5e50e6074e4d90dd1e5f47151fb7894e178b2e5e7be7bd96508c59c50881af83527
SSDEEP

384:SJyG+rgWIsFb3meGda+QO9StNbzXYv2A5ut4GYYfR7WcJMhNxpFPFHB8WX+YRGv6:UyG+rgWrbzGHQOgn7YvX1zh8WXMvi2u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd671afda9dfa794ab85bb26fa0d2005_JaffaCakes118

Files

dd671afda9dfa794ab85bb26fa0d2005_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ab88589aa91345d6e824281b9059f45b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

_controlfp_s
_invoke_watson
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_stricmp
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
vsprintf
strstr
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
srand
rand
memcpy
strcat
strchr
strcpy
strlen
sprintf
_crt_debugger_hook

psapi

GetModuleFileNameExA
EnumProcesses

wininet

InternetOpenA
InternetReadFile
HttpSendRequestA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
InternetOpenUrlA

ws2_32

WSAStartup
socket
sendto
htons
connect
closesocket
recv
WSACleanup
WSAGetLastError
gethostbyname
send

shlwapi

PathFindFileNameA
PathFindExtensionA
StrStrIA
PathFileExistsA
PathCombineA

pdh

PdhOpenQueryA
PdhAddCounterA
PdhCollectQueryData
PdhGetFormattedCounterValue

kernel32

GetTempPathA
GetTickCount
ExitProcess
DeleteFileA
CloseHandle
GetModuleFileNameA
TerminateProcess
Sleep
OpenProcess
CopyFileA
SetFileAttributesA
WaitForSingleObject
CreateMutexA
GetCurrentProcess
GetProcAddress
GetSystemInfo
CreateThread
GetVersionExA
GetLogicalDrives
GetDriveTypeA
GetVolumeInformationA
CreateDirectoryA
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
EncodePointer
SetUnhandledExceptionFilter
DecodePointer
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
CreateFileA
WriteFile
CreateProcessA
GetModuleHandleA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetLastError

user32

GetLastInputInfo
GetSystemMetrics

advapi32

RegCreateKeyExA
RegEnumValueA
RegCloseKey
RegSetValueExA
RegDeleteValueA

shell32

DoEnvironmentSubstA
ShellExecuteA

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab88589aa91345d6e824281b9059f45b

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

psapi

wininet

ws2_32

shlwapi

pdh

kernel32

user32

advapi32

shell32

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 40KB

.rsrc Size: 1024B - Virtual size: 712B

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 40KB

.rsrc
Size: 1024B - Virtual size: 712B