16dba19c31069253e9490eac0b43403f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

16dba19c31069253e9490eac0b43403f_JaffaCakes118
Size

385KB
MD5

16dba19c31069253e9490eac0b43403f
SHA1

90362f1d8b5200255cda234c6edafd97f717bf37
SHA256

aec66c7ece56d1b1548653cbc64ea3a35d3ae9c75bcb582e86cac20bd716676f
SHA512

aceb471769f214af2f3c359bc735036cd4c6fe6c0f5eaa08d24a3ddab57d3a3ea9bc883e56625660713e35480d71f0723e4276c490617c7b74e4a5a28d72ba85
SSDEEP

6144:v52DLqOIrKeMEOHNeN+LvRBCdr6e9g5Lw5Epl0nKw88VcO92aM0f3nebNfL4dWTV:BAtQBCeN+rGFG5LZvvkGPFy2SQTFu6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16dba19c31069253e9490eac0b43403f_JaffaCakes118

Files

16dba19c31069253e9490eac0b43403f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

97fe52729992321fef3eec72f702d405

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetServiceClassInfoA
closesocket
getsockopt
getservbyport
WSALookupServiceBeginW
WSASocketW
socket
WSAIsBlocking
htonl
WSAAsyncGetServByPort
WSASend
WSACancelBlockingCall
WSAAsyncGetProtoByName
WSAStringToAddressA
WSACloseEvent
recv
WSAGetLastError
WEP
WSCEnumProtocols
WSCWriteProviderOrder
WSANtohs
setsockopt
WSAAsyncGetServByName
WSAInstallServiceClassA
WSAConnect
WSASocketA
inet_ntoa
WSAAddressToStringW

kernel32

DeleteTimerQueue
GetStartupInfoW
FindVolumeClose
GetShortPathNameA
ShowConsoleCursor
GetPrivateProfileIntA
GetLongPathNameW
WriteProcessMemory
GetVolumePathNamesForVolumeNameW
CreateJobSet
SetCommConfig
GetTickCount
GetPrivateProfileSectionNamesA
CmdBatNotification
DebugSetProcessKillOnExit
WritePrivateProfileStructW
GetConsoleInputWaitHandle
WriteProfileSectionA
GetCurrentProcessId
QueryPerformanceCounter
lstrcatA
PostQueuedCompletionStatus
GetBinaryType
SetConsoleCtrlHandler
GetCurrentThreadId
GetVolumeInformationW
GlobalFix
GetShortPathNameW
LoadLibraryA
BackupRead
VirtualAlloc
CompareStringW
WTSGetActiveConsoleSessionId
EndUpdateResourceA

odbcjt32

SQLSetPos
SQLProcedureColumnsW
SQLNumParams
SQLNativeSqlW
SQLAllocHandle
SQLSetStmtAttrW
SQLGetInfoW
SQLSetEnvAttr
SQLGetTypeInfoW
SQLGetDiagFieldW
SQLGetData
SQLEndTran
SQLSetCursorNameW
ConfigDSN
InvisibleSelectDb
SQLAllocStmt
SQLGetDescRecW
RepairCompactProc
SQLDriverConnectW
SQLGetDescFieldW
InitDialogAgain
SQLBindCol
SQLSetScrollOptions
SQLPutData
SQLExtendedFetch
SQLExecDirectW

msvcrt40

ldiv
??_Distream@@QAEXXZ
??0ofstream@@QAE@ABV0@@Z
getwchar
sqrt
?lockptr@ios@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
??0strstream@@QAE@PADHH@Z
_ismbcupper
_ismbcsymbol
getenv
_environ
_endthreadex
??_8istream_withassign@@7B@
iswcntrl
__setusermatherr
_adj_fdivr_m32i
??_7__non_rtti_object@@6B@
??_Gios@@UAEPAXI@Z
strtod
??0stdiostream@@QAE@ABV0@@Z

ws2help

WahEnumerateHandleContexts
WahReferenceContextByHandle
WahCompleteRequest
WahNotifyAllProcesses
WahEnableNonIFSHandleSupport
WahCreateNotificationHandle
WahCreateSocketHandle
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahOpenHandleHelper
WahInsertHandleContext
WahDisableNonIFSHandleSupport
WahWaitForNotification
WahCloseThread
WahRemoveHandleContext
WahOpenNotificationHandleHelper
WahCreateHandleContextTable
WahOpenCurrentThread
WahOpenApcHelper
WahCloseHandleHelper
WahDestroyHandleContextTable
WahCloseApcHelper
WahQueueUserApc

msoeacct

GetDllMajorVersion
ValidEmailAddress
DllGetClassObject
DllCanUnloadNow
HrCreateAccountManager

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 759KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97fe52729992321fef3eec72f702d405

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

odbcjt32

msvcrt40

ws2help

msoeacct

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 276KB - Virtual size: 759KB

.tls Size: 512B - Virtual size: 4B

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 512B - Virtual size: 236B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 276KB - Virtual size: 759KB

.tls
Size: 512B - Virtual size: 4B

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 512B - Virtual size: 236B