0e93706cd52af2802281c83a9789f990_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e93706cd52af2802281c83a9789f990_JaffaCakes118
Size

702KB
MD5

0e93706cd52af2802281c83a9789f990
SHA1

0a22836fc585b12d0a51c4d88f2264ec519a27fd
SHA256

ad0373f6f6f29c30ad658c9fce55b9c3bc4d43feb9ce181b5617cc2ea0a58ad0
SHA512

57b14e4200c6203c52bc0919e039f827cc7b30babecd210e2af71cc59791d9bbf2ffa03e055d4c7c24d18009f7fcd2934ca6c7488324e091ae34d6faf53832b7
SSDEEP

12288:H20SXkLPpFEHOrBipeNDLvRm2WSfEEp9rsgjpTbOmsy2Y6e:WkLrEsNJ2Ep9XpnRQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e93706cd52af2802281c83a9789f990_JaffaCakes118

Files

0e93706cd52af2802281c83a9789f990_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fcd72a41591ecd63aa221b6a09eb7d02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
HeapDestroy
GetCommProperties
GetPrivateProfileStringA
GlobalMemoryStatus
GetCommState
SetCommTimeouts
SetCommState
BuildCommDCBA
GetPrivateProfileIntA
SetupComm
Sleep
GetOverlappedResult
CreateEventA
ReadFile
ClearCommError
WriteFile
HeapCreate
HeapAlloc
HeapFree
HeapSize
DuplicateHandle
GetCurrentProcess
GetTickCount
TerminateThread
SleepEx
ResumeThread
CreateThread
GetLastError
GetThreadPriority
SetThreadPriority
ExitThread
SetEvent
WaitForMultipleObjectsEx
CreateMutexA
ReleaseMutex
GetCommandLineA
GetCurrentDirectoryA
SetCurrentDirectoryA
DeviceIoControl
GetDiskFreeSpaceA
WritePrivateProfileStringA
GetFileAttributesA
QueryPerformanceCounter
GetUserDefaultLangID
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetDriveTypeA
GetLogicalDrives
GetVolumeInformationA
FormatMessageA
LocalFree
lstrlenA
lstrcpyA
GetFileType
CreateFileA
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThread
GetCurrentThreadId
InitializeCriticalSection
GetCurrentProcessId
GetConsoleTitleA
FreeEnvironmentStringsW
TlsAlloc
GetEnvironmentStrings
InterlockedIncrement
OutputDebugStringA
HeapReAlloc
GetStdHandle
DebugBreak
InterlockedDecrement
SetConsoleCtrlHandler
GetLocalTime
FatalAppExitA
GetTimeZoneInformation
FlushFileBuffers
GetSystemTime
SetEnvironmentVariableA
RtlUnwind
GetFullPathNameA
GetVersion
GetStartupInfoA
SetFileAttributesA
TlsSetValue
TerminateProcess
GetModuleHandleA
MultiByteToWideChar
HeapValidate
ExitProcess
IsBadWritePtr
WaitForSingleObject
GetExitCodeProcess
DeleteFileA
CompareStringW
CreateProcessA
CompareStringA
GetLocaleInfoW
GetLocaleInfoA
IsBadCodePtr
SetUnhandledExceptionFilter
GetUserDefaultLCID
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
SetEndOfFile
RaiseException
SetFilePointer
SetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetModuleFileNameA
IsBadReadPtr
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetEnvironmentVariableW
LCMapStringW
WideCharToMultiByte
LCMapStringA
TlsGetValue
SetLastError
TlsFree
SetConsoleTitleA
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualProtect

user32

SetCursor
DefWindowProcA
CreateWindowExA
LoadCursorA
PostQuitMessage
ShowCursor
PostMessageA
WaitMessage
DispatchMessageA
MessageBoxA
GetMessageA
PeekMessageA
ShowWindow
GetActiveWindow
UpdateWindow
PtInRect
GetCaretBlinkTime
SetRectEmpty
CopyRect
UnionRect
SetRect
InflateRect
SetCursorPos
BringWindowToTop
GetDC
ReleaseDC
ClientToScreen
AdjustWindowRect
SetFocus
TranslateMessage
GetWindowRect
GetSystemMetrics
LoadIconA
OffsetRect
DestroyWindow
RegisterClassA
GetWindowLongA
wsprintfA
FindWindowA
GetCursorPos
GetDesktopWindow
GetClientRect

gdi32

GetSystemPaletteEntries
GetStockObject

ddraw

DirectDrawEnumerateA
DirectDrawCreate

mss32

_AIL_stop_timer@4
_AIL_set_timer_user@8
_AIL_set_timer_period@8
_AIL_start_timer@4
_AIL_register_timer@4
_AIL_release_timer_handle@4

wsock32

htonl
setsockopt
gethostname
socket
bind
listen
shutdown
closesocket
recv
accept
WSAGetLastError
getsockopt
htons
connect
inet_addr
ntohs
send
select
__WSAFDIsSet
WSAStartup
WSACleanup
inet_ntoa
sendto
recvfrom
gethostbyname
ioctlsocket
getsockname

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

dinput

DirectInputCreateA

Sections

.text
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcd72a41591ecd63aa221b6a09eb7d02

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ddraw

mss32

wsock32

advapi32

dinput

Sections

.text Size: 553KB - Virtual size: 553KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 86KB - Virtual size: 306KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 553KB - Virtual size: 553KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 86KB - Virtual size: 306KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 27KB - Virtual size: 27KB