dfbfe8b8c61050790f42ce118c93011e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dfbfe8b8c61050790f42ce118c93011e_JaffaCakes118
Size

56KB
MD5

dfbfe8b8c61050790f42ce118c93011e
SHA1

1da9b49403557a39fa426bdd61076beb462cbaeb
SHA256

f975f2b5a3798ef5a9a0f1fcf15a3067bdb3490d8bb1c60a957bdc3c47be59a8
SHA512

4b9045365b4c66cb1c7a590cbee352dfc6cf7b24d016bd3fab8d4095f4b9780b201756dfded6e5b23680cf5559d131929bc93150fbfa3e4dbabc5cdd600e6400
SSDEEP

768:7+hfg2tspEuDwU0SFPumxllZmCk/tcr5xCFj0sj65Ol0rhIHQPLpxkw7DfL:z2tILwu9xllZmCstcV8h0sIOmrz/FDT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfbfe8b8c61050790f42ce118c93011e_JaffaCakes118

Files

dfbfe8b8c61050790f42ce118c93011e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f3d56df44feab99b99e767f86a810804

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\My Documents\Visual Studio Projects\phwin\Release\phwinm.pdb

Imports

kernel32

InterlockedDecrement
lstrlenA
GetWindowsDirectoryA
CloseHandle
WriteFile
CreateFileA
lstrcpyA
lstrcatA
GetTickCount
GetLastError
GetCurrentThreadId
GetSystemDirectoryA
ReadFile
SetFilePointer
DeleteCriticalSection
InterlockedIncrement
DeleteFileA
Sleep
SetStdHandle
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetFileType
InitializeCriticalSection
RaiseException
GetVersionExA
GetLocaleInfoA
GetACP
FlushFileBuffers
InterlockedExchange
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
GetCurrentProcess
TerminateProcess
GetProcAddress
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapFree
ExitProcess

user32

CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowPos
wsprintfA
GetLastInputInfo
MessageBoxA
CharLowerA
CharNextA

advapi32

OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenSCManagerA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetMalloc

ole32

CoInitialize
CoUninitialize

ws2_32

WSAStartup
WSACleanup
closesocket
htons
gethostbyname
socket
WSAGetLastError
send
connect
recv

ntdll

RtlUnwind

iphlpapi

GetAdaptersInfo

wininet

InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA
FtpSetCurrentDirectoryA
InternetOpenA
FtpGetFileA
InternetConnectA
InternetReadFile

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f3d56df44feab99b99e767f86a810804

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

ws2_32

ntdll

iphlpapi

wininet

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 8KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 8KB