0d7bcb7575bb87d7eb1faf4b836e7e23_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0d7bcb7575bb87d7eb1faf4b836e7e23_JaffaCakes118
Size

136KB
MD5

0d7bcb7575bb87d7eb1faf4b836e7e23
SHA1

9eb25d3cf9055a08287692cdcb4d0b218ad6af72
SHA256

c99c3470b1809ad3aa8ea82ca3242c5676e700938b625297d058ded58b465765
SHA512

f87a0af05b4af4b1d144912b3149db3f1cfd633351ddedd632ccd5d2d0985863d02e155fda4728d5a45210d00369b22e4606f1d34eedd338ef8c77d02a457e29
SSDEEP

1536:8zHfUGCNiunKsRb7sj05rLreJA4j0xPkciQ38a6tFcjJqXg+2Tl5zO:S/wb427iQ38a6tFQoXgFZ5i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d7bcb7575bb87d7eb1faf4b836e7e23_JaffaCakes118

Files

0d7bcb7575bb87d7eb1faf4b836e7e23_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d5c2bf1d9a4f650dace32db1821a71c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Dev\My Documents\Sources\DNS Failure\release\netmon.pdb

Imports

shlwapi

PathAppendW

shell32

SHGetFolderPathW

user32

MessageBoxW

advapi32

RegisterServiceCtrlHandlerW
DeleteService
ControlService
OpenServiceW
CloseServiceHandle
StartServiceW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
OpenSCManagerW
CreateServiceW

wininet

InternetOpenW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetConnectW

kernel32

WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
GetACP
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RtlUnwind
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
WriteFile
GetExitCodeProcess
TerminateProcess
CreateDirectoryW
GetLastError
SetFilePointer
WideCharToMultiByte
FlushFileBuffers
CreateFileW
CloseHandle
CreatePipe
GetEnvironmentVariableW
CreateProcessW
PeekNamedPipe
ReadFile
WaitForSingleObject
SetEndOfFile
Sleep
GetCurrentDirectoryW
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
ExitProcess
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
SetEnvironmentVariableA
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RaiseException
GetTimeZoneInformation
MultiByteToWideChar
GetTimeFormatA
GetDateFormatA
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8d5c2bf1d9a4f650dace32db1821a71c

Headers

File Characteristics

PDB Paths

Imports

shlwapi

shell32

user32

advapi32

wininet

kernel32

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 48KB - Virtual size: 68KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 48KB - Virtual size: 68KB