fe211c7a081c1dac46e3935f7c614549_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fe211c7a081c1dac46e3935f7c614549_JaffaCakes118
Size

68KB
MD5

fe211c7a081c1dac46e3935f7c614549
SHA1

a99b7d88db7c16e7a537f87b199909091b52df53
SHA256

551af522d2adbc24c3821a3408d231045da0d4dc55ff559b0c8049d36d10a16d
SHA512

40aaa5c607a2276a2efadb044ea637226c4bd96d2b2fd27b80558b69da957409b10d7b79877266a9e05ed809d802275aae0d81aea0e80477a1bb456c6eb2ac6a
SSDEEP

1536:JnRgvoELEEEEEBZGtCNe/uINFyE5AMiiNndj:9q60/rKMiiX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe211c7a081c1dac46e3935f7c614549_JaffaCakes118

Files

fe211c7a081c1dac46e3935f7c614549_JaffaCakes118
.exe windows:4 windows x86 arch:x86

39af2d12ee5084817ee98e5c8f868679

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
SetSecurityInfo
SetEntriesInAclA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetTokenInformation
OpenProcessToken
LookupAccountSidA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA

wsock32

WSAStartup
WSAGetLastError
WSACleanup
socket
htons
ioctlsocket
inet_ntoa
connect
select
recv
gethostname
gethostbyname
inet_addr
closesocket
send

mpr

WNetCloseEnum

shlwapi

SHSetValueA
SHGetValueA
SHDeleteValueA
SHDeleteKeyA

netapi32

NetGetDCName
NetApiBufferFree

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize
CoCreateInstance

user32

mouse_event
SendMessageA
GetForegroundWindow
GetWindow
GetWindowRect
GetWindowTextA
GetClassNameA
GetSystemMetrics

msvcrt

fclose
fread
fseek
fopen
fwrite
swprintf
isdigit
isalpha
exit
atoi
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
rename
_controlfp
_strnicmp
sprintf
memset
strchr
memcpy
memcmp
strncpy
free
time
srand
rand
strcpy
strcat
malloc
strlen
strcmp
_EH_prolog
__CxxFrameHandler
strrchr
_access
strstr
_itoa

kernel32

GetVolumeInformationA
GetStartupInfoA
PeekNamedPipe
ReadFile
GetModuleHandleA
WriteFile
GetModuleFileNameA
SetCurrentDirectoryA
CreateProcessA
MultiByteToWideChar
GlobalAlloc
GlobalFree
DeleteFileA
GetVersionExA
GetFileSize
CopyFileA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
FindClose
CreateFileA
CreateDirectoryA
GetFileAttributesA
SetFileAttributesA
TerminateProcess
GetPriorityClass
GetWindowsDirectoryA
OpenProcess
GetCurrentProcess
DuplicateHandle
GetLastError
LocalFree
GetLogicalDriveStringsA
GetSystemDefaultLangID
LoadLibraryA
GetDriveTypeA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
FreeLibrary
GetComputerNameA
OpenMutexA
CloseHandle
SetEvent
WaitForSingleObject
CreateMutexA
CreateEventA
GetTickCount
CreateThread
Sleep

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39af2d12ee5084817ee98e5c8f868679

Headers

File Characteristics

Imports

advapi32

wsock32

mpr

shlwapi

netapi32

shell32

ole32

user32

msvcrt

kernel32

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 24KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 24KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 3KB