fc8ed2e20e8f6423c78e142b168c7911_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc8ed2e20e8f6423c78e142b168c7911_JaffaCakes118
Size

274KB
MD5

fc8ed2e20e8f6423c78e142b168c7911
SHA1

de63c366e0ba102c248d48b43bfbc85dfe6dae2d
SHA256

fa018d3d8b470d0b4817e48de3ce14c96842684d8f81a62e619dc2490ad10e39
SHA512

e0e93e1733adf3e8bb575204ab494795fbfc0bcea3ed0c15d6c6818639059cd1d8a017df5e5306d9fa06d0f749c68c8c65ca4d09f38e2ed928340baa9d9a0197
SSDEEP

6144:yTsti8k7fxVP2+EIXBJeMb75EfavwH5bmgHc5aae9:yTL7pVpE2BJFFEfLHsgHUPA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc8ed2e20e8f6423c78e142b168c7911_JaffaCakes118

Files

fc8ed2e20e8f6423c78e142b168c7911_JaffaCakes118
.dll windows:5 windows x86 arch:x86

38489c9b6d02914bdf5f1dc6747a6269

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

kernel32

Sleep
VirtualFree
VirtualAlloc
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
SetThreadLocale
WideCharToMultiByte
MultiByteToWideChar
GetACP
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetCommandLineW
FreeLibrary
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
lstrlen
lstrcpy
WriteFile
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
UnmapViewOfFile
Sleep
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessWorkingSetSize
SetFileTime
SetFilePointer
SetFileAttributesA
SetEndOfFile
ReadFile
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexA
OpenFileMappingA
MoveFileA
MapViewOfFile
LocalFree
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GetVolumeInformationA
GetVersionExW
GetTimeFormatA
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameA
GetLocalTime
GetLastError
GetFileTime
GetFileSize
GetFileAttributesA
GetDateFormatA
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCommandLineA
InterlockedIncrement
FreeLibrary
FormatMessageA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
ExpandEnvironmentStringsA
ExitThread
ExitProcess
EnterCriticalSection
DeviceIoControl
DeleteFileA
CreateThread
CreateMutexA
CreateFileMappingA
CreateFileMappingW
CreateFileA
CreateFileW
CreateDirectoryA
CompareStringA
CloseHandle
GetVersionExA

user32

CharUpperBuffA
wvsprintfW
wvsprintfA

advapi32

SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
SetKernelObjectSecurity
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
InitiateSystemShutdownA
InitializeSecurityDescriptor
GetTokenInformation
GetSecurityDescriptorDacl
GetKernelObjectSecurity
AdjustTokenPrivileges
SetNamedSecurityInfoA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA

ntdll

NtQuerySystemInformation
NtQuerySystemTime

ole32

CLSIDFromString

wsock32

WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
sendto
recvfrom
htons
ioctlsocket
inet_ntoa
inet_addr
htons
closesocket

netapi32

Netbios

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiClassNameFromGuidW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW

iphlpapi

GetAdaptersInfo

wininet

InternetSetOptionA
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

dnsapi

DnsFlushResolverCache
DnsFlushResolverCache

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38489c9b6d02914bdf5f1dc6747a6269

Headers

File Characteristics

Imports

oleaut32

kernel32

user32

advapi32

ntdll

ole32

wsock32

netapi32

setupapi

iphlpapi

wininet

dnsapi

Sections

.text Size: 235KB - Virtual size: 234KB

.itext Size: 1KB - Virtual size: 1KB

.data Size: 10KB - Virtual size: 10KB

.bss Size: - Virtual size: 21KB

.idata Size: 5KB - Virtual size: 5KB

.didata Size: 512B - Virtual size: 152B

.rdata Size: 512B - Virtual size: 68B

.reloc Size: 18KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 1024B

.text
Size: 235KB - Virtual size: 234KB

.itext
Size: 1KB - Virtual size: 1KB

.data
Size: 10KB - Virtual size: 10KB

.bss
Size: - Virtual size: 21KB

.idata
Size: 5KB - Virtual size: 5KB

.didata
Size: 512B - Virtual size: 152B

.rdata
Size: 512B - Virtual size: 68B

.reloc
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 1024B