fcf83ff5473fd66998c482492b3db378_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fcf83ff5473fd66998c482492b3db378_JaffaCakes118
Size

45KB
MD5

fcf83ff5473fd66998c482492b3db378
SHA1

1de0809343b19b4560ae9ee6e0c849ae06112e85
SHA256

3c6c080c966bcdcedafd08bff910929992c833e101ca0cfe15bb26452f1d2e91
SHA512

3ef5a352a5744bdb6058af96cfc4b2f97a7940a493a576a750b5bd332b65b6e4aa9fbaeeed0d0beb306ad1eace481f71f2bb6db43f1c3c5d9b160279a96ecb30
SSDEEP

768:rPJ/UULkisoExTrr/ReDE3bVPfhU5zt4gy0tFTLxpvrgQhPDLUb/dWvwS2IeTBpY:lZonoExrgW3U5n/rEyPv2S2Pn/NlNC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcf83ff5473fd66998c482492b3db378_JaffaCakes118

Files

fcf83ff5473fd66998c482492b3db378_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
recv
WSACleanup
WSAGetLastError
closesocket
WSAStartup
socket
connect

kernel32

GetCommandLineA
GetStartupInfoA
Process32First
Process32Next
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
SetPriorityClass
GetCurrentProcess
ExitProcess
CloseHandle
CreateMutexA
lstrcpyA
lstrcatA
lstrlenA
CreateEventA
GetModuleFileNameA
GetWindowsDirectoryA
GetCurrentThreadId
ResumeThread
CreateThread
DeleteFileA
GlobalMemoryStatus
GetCurrentProcessId
HeapAlloc
GetProcessHeap
TerminateProcess
WriteProcessMemory
GetThreadContext
ReadProcessMemory
GetModuleHandleA

user32

DispatchMessageA
TranslateMessage
SendMessageA
ShowWindow
CreateWindowExA
RegisterClassA
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
DefWindowProcA
ExitWindowsEx
UpdateWindow

advapi32

RegSetValueExA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

ntdll

RtlUnwind
ZwUnmapViewOfSection
sprintf
strcspn
strncpy
atoi
strstr
_strlwr
_itoa
_strupr

msvcirt

??_Dofstream@@QAEXXZ
??_Difstream@@QAEXXZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?close@ifstream@@QAEXXZ
?write@ostream@@QAEAAV1@PBDH@Z
?read@istream@@QAEAAV1@PADH@Z
?open@ofstream@@QAEXPBDHH@Z
??0ofstream@@QAE@XZ
?open@ifstream@@QAEXPBDHH@Z
?openprot@filebuf@@2HB
??0ifstream@@QAE@XZ

msvcrt

printf
__CxxFrameHandler
malloc

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Fi7ke
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cfba65fcab286a7f48dbb8a32b5cdd0e

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

ntdll

msvcirt

msvcrt

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 6KB

Fi7ke Size: 512B - Virtual size: 512B

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 6KB

Fi7ke
Size: 512B - Virtual size: 512B