1143b06d1576568fdfd4ddd330623a24_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1143b06d1576568fdfd4ddd330623a24_JaffaCakes118
Size

61KB
MD5

1143b06d1576568fdfd4ddd330623a24
SHA1

cc7f823503de6039bc7cdbab2d08ae4802425131
SHA256

b3a20cb1aee0d06d22809247c8a48eaf4ec274c00eb52baa9e7f8ec4ad8b84c0
SHA512

5f1c9a27bbd75646603932f17af1d4e5102d79cd52106678e96397c66c51f0be0deca2185de61cc3af99acf9839e04f080922bfd6d4f92747b808326407b4ee1
SSDEEP

1536:Urh6QWdp0t/DFpX7Um8srp+Y0UtaqhBmKfiIaStOLp0:zHd0zQdSp+YDtaqh8KfiIaStOK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1143b06d1576568fdfd4ddd330623a24_JaffaCakes118

Files

1143b06d1576568fdfd4ddd330623a24_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6f68401d592987dbf451599c8030dc96

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

shlwapi

StrStrIA
wnsprintfA
StrStrA

ws2_32

getsockname
setsockopt
closesocket
recvfrom
WSAGetLastError
recv
sendto
getsockopt
WSAStartup
socket
connect
htons
htonl
inet_addr
WSASetLastError
inet_ntoa
gethostbyname
send

kernel32

RtlUnwind
InterlockedExchange
SetLastError
GetOverlappedResult
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpW
GetSystemTime
GetEnvironmentVariableA
CreateProcessA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateFileA
GetCommandLineA
GetVersion
MapViewOfFile
CreateFileMappingA
CreateThread
GetCurrentThreadId
CreateMutexA
CloseHandle
OpenMutexA
Sleep
ExitProcess
ExitThread
TerminateThread
OpenThread
lstrcmpA
lstrlenW
IsBadReadPtr
lstrcmpiA
GetTickCount
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
IsBadWritePtr
WaitForSingleObject
ReleaseMutex
SystemTimeToFileTime
GetTimeZoneInformation
GetLastError
DeviceIoControl
VirtualQuery

user32

wsprintfA
GetDC
CharLowerA

dnsapi

DnsQuery_A
DnsExtractRecordsFromMessage_W
DnsRecordListFree

gdiplus

GdipDeleteGraphics
GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
GdipPrivateAddMemoryFont
GdipDeleteFont
GdipDeletePen
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawString
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipCreatePen1
GdipDeleteBrush
GdipFree
GdipAlloc
GdipLoadImageFromStream

gdi32

GetTextExtentPoint32A

ole32

CreateStreamOnHGlobal

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f68401d592987dbf451599c8030dc96

Headers

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

gdiplus

gdi32

ole32

Sections

.text Size: 58KB - Virtual size: 57KB

.data Size: 2KB - Virtual size: 21.7MB

.text
Size: 58KB - Virtual size: 57KB

.data
Size: 2KB - Virtual size: 21.7MB