0b60c9c1220a1c2768274d94cc4a747a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0b60c9c1220a1c2768274d94cc4a747a_JaffaCakes118
Size

260KB
MD5

0b60c9c1220a1c2768274d94cc4a747a
SHA1

7e4bc8d1b9d3957683de3e05834cad00a07475f1
SHA256

1a452111a9f3a1d31a435a365b7a4ed11cc5e595739bde72e87423b22864e7b2
SHA512

71bba6a6ecdb398c7c0b00c602d949b86d0f27bbe335ea9d8c7f2a9dafc7dca3b742571b0d0264b5feea86af5b12c8f61e3d52259802699ac985cdd4c2bd21b1
SSDEEP

3072:7GNoIu4QTNuYelHfXbU6uFejSvIocTkhHhwwChWcfLZZsqiQqlCEqEP4:7GNoIujIH/bU/iSUTIHywmLni7oEqEw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b60c9c1220a1c2768274d94cc4a747a_JaffaCakes118

Files

0b60c9c1220a1c2768274d94cc4a747a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc10ce74da3de7f2825a147192680d0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__CxxFrameHandler
__dllonexit
??1type_info@@UAE@XZ
_endthreadex
_beginthreadex
_except_handler3
sprintf
isdigit
printf
perror
_errno
strerror
fflush
sscanf
calloc
strcat
toupper
fputc
wcscat
strtok
_ftol
rand
srand
__set_app_type
fseek
ftell
malloc
free
exit
strncmp
atof
memcmp
strchr
strncat
vsprintf
fprintf
system
atoi
strcpy
_memccpy
_stricmp
fgets
fopen
fread
strcmp
fclose
time
gmtime
strftime
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
_EH_prolog
_controlfp
fwrite
_strdup

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
RaiseException
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
ResumeThread
WaitForSingleObject
ResetEvent
InterlockedDecrement
CreateThread
TransactNamedPipe
MultiByteToWideChar
GetLastError
GetSystemDirectoryA
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
OutputDebugStringA
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
CreateFileA
TerminateProcess
GetTickCount
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ReadFile
CloseHandle

user32

ExitWindowsEx
wsprintfA

advapi32

CloseServiceHandle
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
RegSetValueExA
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ws2_32

WSAGetLastError
recv
send
getsockname
getpeername
ioctlsocket
gethostbyname
inet_ntoa
gethostbyaddr
ntohs
select
gethostname
htonl
sendto
setsockopt
WSASocketA
WSASetLastError
getsockopt
getservbyname
shutdown
inet_addr
__WSAFDIsSet
accept
bind
listen
closesocket
socket
htons
connect
WSACleanup
WSAIoctl
WSAStartup

mpr

WNetCancelConnection2W
WNetAddConnection2W

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

dnsapi

DnsQuery_A

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.diabloz
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dc10ce74da3de7f2825a147192680d0b

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

mpr

psapi

dnsapi

Sections

.text Size: 164KB - Virtual size: 162KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 52KB - Virtual size: 60KB

.diabloz Size: 16KB - Virtual size: 16KB

.text
Size: 164KB - Virtual size: 162KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 52KB - Virtual size: 60KB

.diabloz
Size: 16KB - Virtual size: 16KB