fd7665d4afbf9dc5ebbadb59b300e5b3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fd7665d4afbf9dc5ebbadb59b300e5b3_JaffaCakes118
Size

855KB
MD5

fd7665d4afbf9dc5ebbadb59b300e5b3
SHA1

f82d843fc73f18962fcf56ab9008fbec84223a6f
SHA256

aa67bda7b330b4878bcfa4ce9491a44421eddf34f4c03b346af9fcde64c433bb
SHA512

dc7ebc2708cfd5f5c3de60d3ee05106bc4d1b53ef66ac37ed65eefee43d94b4b85ecb479b9ecb5e944259ee4d64e7ec9be08c5c4883cf994b255aaa1cd4cb57d
SSDEEP

24576:lIX7l//+NYqDjLLYKLjTuI517je/cP3Wc4SBiN7Ow:lC//NqPLrTuyBkcPmjSB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd7665d4afbf9dc5ebbadb59b300e5b3_JaffaCakes118

Files

fd7665d4afbf9dc5ebbadb59b300e5b3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

acb6cce1e88e68cfe798ae3cdb73aea0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isnan
_CItanh
_pgmptr
atan2
fflush
iswctype
__p___mb_cur_max
cosh
islower
_putws
_execlp
_adj_fprem
iswxdigit
__CxxDetectRethrow
_execve
free
_wutime64
_wopen
__getmainargs
_getdrive
_nextafter
??1exception@@UAE@XZ
_CIsinh
??0bad_cast@@AAE@PBQBD@Z
__CxxUnregisterExceptionObject
memcpy
_wunlink
_set_error_mode
_global_unwind2
_fstat
_ltow
_ismbchira
_ismbbkalnum
_wpopen
atexit
iswcntrl
_getws
wctomb
__p__pwctype
sin
_control87
__wcserror
_spawnlpe
??_E__non_rtti_object@@UAEPAXI@Z
__p__commode
_adj_fdivr_m64
_mbctohira
__set_app_type
_chkesp
_toupper
_vsnwprintf
wcsncmp
_unloaddll
_findnext
_mbsncmp
_ultow
??_7bad_typeid@@6B@
_tzname
fprintf
exit
_fputwchar
div
?_query_new_handler@@YAP6AHI@ZXZ
_fullpath
_wfindfirsti64
_mbsupr
_commit
__RTDynamicCast
__wargv
_mbbtype
strncat
_ismbcprint
_ismbcdigit
__argv
_CIatan
toupper
_gcvt
?_query_new_mode@@YAHXZ
_wfindnexti64
__uncaught_exception
_getmbcp
?set_terminate@@YAP6AXXZP6AXXZ@Z
_mbsnbset
_wperror
_clearfp
_getwche

rasapi32

RasEnumDevicesW
RasGetErrorStringA
RasGetEapUserDataA
RasSetSharedAutoDial
RasGetConnectStatusW
RasSetAutodialEnableA
RasQuerySharedAutoDial
RasGetAutodialEnableA
RasSetAutodialEnableW
RasSetEntryDialParamsA
RasGetCustomAuthDataW
RasHangUpA
RasSetAutodialAddressW
RasGetSubEntryPropertiesW
RasDeleteEntryW
RasScriptSend
RasGetEapUserIdentityA
RasGetErrorStringW
RasDeleteSubEntryA
RasFreeEapUserIdentityA
RasEditPhonebookEntryA
DwEnumEntryDetails
UnInitializeRAS
RasAutodialEntryToNetwork
RasDeleteEntryA
RasAutoDialSharedConnection
DDMGetPhonebookInfo
RasCreatePhonebookEntryA
RasIsSharedConnection
RasClearConnectionStatistics
RasSetOldPassword
RasSetAutodialParamA
RasGetEapUserDataW
RasSetSubEntryPropertiesA
RasAutodialAddressToNetwork
RasEnumEntriesA
RasDialW
RasRenameEntryW
RasGetProjectionInfoW
RasGetConnectionStatistics
RasGetAutodialParamA
RasGetConnectStatusA
RasScriptTerm
RasGetSubEntryHandleW
RasValidateEntryNameA

kernel32

GetExpandedNameA
GetProcessPriorityBoost
LZCloseFile
LocalFileTimeToFileTime
GetFullPathNameA
RtlCaptureContext
FileTimeToDosDateTime
GetNamedPipeHandleStateW
GetNumberOfConsoleInputEvents
InitializeCriticalSection
SetVolumeLabelW
LoadLibraryA
FindFirstFileW
CloseConsoleHandle
GetTapeParameters
FormatMessageA
lstrlenW
lstrcpynW
GetSystemWindowsDirectoryW
DosPathToSessionPathA
FreeLibraryAndExitThread
FindActCtxSectionStringA
OpenSemaphoreW
SetLastConsoleEventActive
TransactNamedPipe
VirtualAlloc
Process32Next
BindIoCompletionCallback
GetSystemTime
ContinueDebugEvent
SetCalendarInfoW

user32

MapDialogRect
PackDDElParam
WCSToMBEx
DdeEnableCallback
keybd_event
SetWindowPos
EnableWindow
GetWindowThreadProcessId
PrintWindow
IsDialogMessageA
GetWindowDC
SendMessageCallbackW
LoadCursorW
GetDoubleClickTime
GetWindowPlacement
GetCursor
MB_GetString
LoadRemoteFonts
LookupIconIdFromDirectory
PostQuitMessage
MessageBoxW
OemToCharBuffW
ModifyMenuA
GetMenuItemID
GetUserObjectSecurity
EnumPropsExA
IsCharAlphaA
CharUpperBuffA
DdeConnectList
LoadImageA

rtm

RtmDeregisterEntity
RtmGetInstances
RtmWriteInstanceConfig
RtmCreateDestEnum
RtmGetEnumDests
RtmGetLessSpecificDestination
RtmGetChangedDests
RtmReleaseRouteInfo
RtmDeleteRouteList
RtmIgnoreChangedDests
RtmGetRegisteredEntities
MgmTakeInterfaceOwnership
RtmLockNextHop
RtmGetEnumRoutes
RtmGetRoutePointer
RtmCreateRouteListEnum
RtmReleaseNextHops
RtmRegisterForChangeNotification
RtmAddNextHop
MgmAddGroupMembershipEntry
RtmGetOpaqueInformationPointer
RtmReleaseChangedDests
RtmGetInstanceInfo
MgmGetMfe
RtmGetRouteInfo
RtmReleaseNextHopInfo
InsertIntoTable
RtmGetListEnumRoutes
RtmReadAddressFamilyConfig
RtmLockRoute
CheckTable
RtmAddRouteToDest
RtmGetEntityMethods
RtmIsMarkedForChangeNotification
RtmRegisterClient
MgmGetNextMfe

Sections

.text
Size: 335KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 313KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

acb6cce1e88e68cfe798ae3cdb73aea0

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

rasapi32

kernel32

user32

rtm

Sections

.text Size: 335KB - Virtual size: 335KB

.rdata Size: 204KB - Virtual size: 204KB

.data Size: 313KB - Virtual size: 1.7MB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 335KB - Virtual size: 335KB

.rdata
Size: 204KB - Virtual size: 204KB

.data
Size: 313KB - Virtual size: 1.7MB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 1024B - Virtual size: 1024B