efd847c29ae8c54b07d9213f6780d08e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

efd847c29ae8c54b07d9213f6780d08e_JaffaCakes118
Size

855KB
MD5

efd847c29ae8c54b07d9213f6780d08e
SHA1

f23f9d69c674dbe42e60ef5e4c2a0c6343b7779b
SHA256

ab7e950286ccb3877b005e001f0656873123ca3f81156bd9920e1f587db8250b
SHA512

b15470a7f6ffa3166f57271190ea70625cb5c50e1546bb36f87dc1c03efefde470ecf47b101d8309534cc3ba23a0f0bc131b1066fa7cf37cba8617f2f3c5453a
SSDEEP

12288:C50fEQTbsuBFxEhrvIW2d9Ed1ZDtj2wJ2zn4ev9XvX7RrxN6jPLt:C50cQPBFSVvINOPZEykJxvX1fcPJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efd847c29ae8c54b07d9213f6780d08e_JaffaCakes118

Files

efd847c29ae8c54b07d9213f6780d08e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ce9abf90a6baf6395689a25e492b951c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cmutil

?WPPB@CIniW@@QAEXPBG0H@Z
?Banner@CmLogFile@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?Generate@CRandom@@QAEHXZ
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
CmLoadSmallIconA
CmStrCpyAllocA
?SetRegPath@CIniW@@QAEXPBG@Z
?GetSection@CIniW@@QBEPBGXZ
CmStrchrW
CmLoadIconA
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
??0CRandom@@QAE@I@Z
?IsEnabled@CmLogFile@@QAEHXZ
?WPPI@CIniA@@QAEXPBD0K@Z
?GetFile@CIniA@@QBEPBDXZ
?Clear@CIniA@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
CmBuildFullPathFromRelativeA
?LoadEntry@CIniW@@IBEPAGPBG@Z
CmConvertRelativePathW

wsock32

WSASetLastError
WSAAsyncGetProtoByNumber
accept
WEP
GetServiceA
gethostname
GetNameByTypeW
NPLoadNameSpaces
recvfrom
bind
SetServiceA
MigrateWinsockConfiguration
WSAUnhookBlockingHook
ioctlsocket
sendto
TransmitFile
getprotobynumber
WSAAsyncGetHostByAddr
connect
AcceptEx

kernel32

ConvertThreadToFiber
VirtualAlloc
TerminateThread
DeleteFileA
GetTempFileNameA
LeaveCriticalSection
IsValidLanguageGroup
IsDBCSLeadByte
GetProfileSectionA
GetConsoleNlsMode
LZSeek
IsBadHugeReadPtr
GetEnvironmentStringsW
GetModuleFileNameA
GlobalHandle
ReadConsoleInputExA
LoadLibraryA
GetCommModemStatus
GetFileAttributesA
SetFirmwareEnvironmentVariableA
GetBinaryTypeA
EnumDateFormatsExW
SetVolumeMountPointW
WriteConsoleOutputCharacterW
ReleaseSemaphore

crtdll

_utime
fscanf
time
_global_unwind2
abort
_wcsset
_rmdir
fmod
_execvpe
getenv
iswalpha
strcpy
fread
_rmtmp
_mktemp
fseek
_mbsnbcpy

Sections

.text
Size: 756KB - Virtual size: 756KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce9abf90a6baf6395689a25e492b951c

Headers

DLL Characteristics

File Characteristics

Imports

cmutil

wsock32

kernel32

crtdll

Sections

.text Size: 756KB - Virtual size: 756KB

.rdata Size: 91KB - Virtual size: 90KB

.data Size: 4KB - Virtual size: 1.4MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 756KB - Virtual size: 756KB

.rdata
Size: 91KB - Virtual size: 90KB

.data
Size: 4KB - Virtual size: 1.4MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB