0220351a9c1ef07bca697fe9108bd245_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0220351a9c1ef07bca697fe9108bd245_JaffaCakes118
Size

168KB
MD5

0220351a9c1ef07bca697fe9108bd245
SHA1

f56f1709fdcf91c21b947e0a770706b0665eda8e
SHA256

09a5704be6205baddde52b2f582360545862f1739db23c989db436dd202740de
SHA512

6443159aa66d4148baaa38450244de48d4548a24f6160b9c3706174f28ad179ee7b5207a9234757ec3f674558b9c02601877c3402c40b7cf9fef925a384e5c4b
SSDEEP

1536:AzHfUGlNiunKsRb7sj05rLreJA4j0xPuciQ38a6tFcuJK47X3RLH:O/Lb42ViQ38a6tFlJK47RL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0220351a9c1ef07bca697fe9108bd245_JaffaCakes118

Files

0220351a9c1ef07bca697fe9108bd245_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d5c2bf1d9a4f650dace32db1821a71c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Dev\My Documents\Sources\DNS Failure\release\netmon.pdb

Imports

shlwapi

PathAppendW

shell32

SHGetFolderPathW

user32

MessageBoxW

advapi32

RegisterServiceCtrlHandlerW
DeleteService
ControlService
OpenServiceW
CloseServiceHandle
StartServiceW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
OpenSCManagerW
CreateServiceW

wininet

InternetOpenW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetConnectW

kernel32

WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
GetACP
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RtlUnwind
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
WriteFile
GetExitCodeProcess
TerminateProcess
CreateDirectoryW
GetLastError
SetFilePointer
WideCharToMultiByte
FlushFileBuffers
CreateFileW
CloseHandle
CreatePipe
GetEnvironmentVariableW
CreateProcessW
PeekNamedPipe
ReadFile
WaitForSingleObject
SetEndOfFile
Sleep
GetCurrentDirectoryW
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
ExitProcess
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
SetEnvironmentVariableA
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RaiseException
GetTimeZoneInformation
MultiByteToWideChar
GetTimeFormatA
GetDateFormatA
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8d5c2bf1d9a4f650dace32db1821a71c

Headers

File Characteristics

PDB Paths

Imports

shlwapi

shell32

user32

advapi32

wininet

kernel32

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 48KB - Virtual size: 68KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 48KB - Virtual size: 68KB