27c7e24caf896f6b678b67b21df29afd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27c7e24caf896f6b678b67b21df29afd_JaffaCakes118
Size

385KB
MD5

27c7e24caf896f6b678b67b21df29afd
SHA1

cd1af7281e572f99e843b57b24e8e26d8a6e7083
SHA256

8102dcd205b51112b50e278087af16f45bc84e891fd664e56980a40ad458025c
SHA512

cfc822efec03e4245e64612d9d78c5ff0df5ff0ca481885bf54f71baf7416accb3c140a1591932311e9d9d680520c8a0d97cf5213358f019d75da6ff6323dbe8
SSDEEP

6144:o52DLqOIrKeMEOHNeN+LvRBCdr6e9g5Lw5Epl0nKw88VcO92aM0f3nebNfL4dWTV:mAtQBCeN+rGFG5LZvvkGPFy2SQTFu6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27c7e24caf896f6b678b67b21df29afd_JaffaCakes118

Files

27c7e24caf896f6b678b67b21df29afd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

97fe52729992321fef3eec72f702d405

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetServiceClassInfoA
closesocket
getsockopt
getservbyport
WSALookupServiceBeginW
WSASocketW
socket
WSAIsBlocking
htonl
WSAAsyncGetServByPort
WSASend
WSACancelBlockingCall
WSAAsyncGetProtoByName
WSAStringToAddressA
WSACloseEvent
recv
WSAGetLastError
WEP
WSCEnumProtocols
WSCWriteProviderOrder
WSANtohs
setsockopt
WSAAsyncGetServByName
WSAInstallServiceClassA
WSAConnect
WSASocketA
inet_ntoa
WSAAddressToStringW

kernel32

DeleteTimerQueue
GetStartupInfoW
FindVolumeClose
GetShortPathNameA
ShowConsoleCursor
GetPrivateProfileIntA
GetLongPathNameW
WriteProcessMemory
GetVolumePathNamesForVolumeNameW
CreateJobSet
SetCommConfig
GetTickCount
GetPrivateProfileSectionNamesA
CmdBatNotification
DebugSetProcessKillOnExit
WritePrivateProfileStructW
GetConsoleInputWaitHandle
WriteProfileSectionA
GetCurrentProcessId
QueryPerformanceCounter
lstrcatA
PostQueuedCompletionStatus
GetBinaryType
SetConsoleCtrlHandler
GetCurrentThreadId
GetVolumeInformationW
GlobalFix
GetShortPathNameW
LoadLibraryA
BackupRead
VirtualAlloc
CompareStringW
WTSGetActiveConsoleSessionId
EndUpdateResourceA

odbcjt32

SQLSetPos
SQLProcedureColumnsW
SQLNumParams
SQLNativeSqlW
SQLAllocHandle
SQLSetStmtAttrW
SQLGetInfoW
SQLSetEnvAttr
SQLGetTypeInfoW
SQLGetDiagFieldW
SQLGetData
SQLEndTran
SQLSetCursorNameW
ConfigDSN
InvisibleSelectDb
SQLAllocStmt
SQLGetDescRecW
RepairCompactProc
SQLDriverConnectW
SQLGetDescFieldW
InitDialogAgain
SQLBindCol
SQLSetScrollOptions
SQLPutData
SQLExtendedFetch
SQLExecDirectW

msvcrt40

ldiv
??_Distream@@QAEXXZ
??0ofstream@@QAE@ABV0@@Z
getwchar
sqrt
?lockptr@ios@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
??0strstream@@QAE@PADHH@Z
_ismbcupper
_ismbcsymbol
getenv
_environ
_endthreadex
??_8istream_withassign@@7B@
iswcntrl
__setusermatherr
_adj_fdivr_m32i
??_7__non_rtti_object@@6B@
??_Gios@@UAEPAXI@Z
strtod
??0stdiostream@@QAE@ABV0@@Z

ws2help

WahEnumerateHandleContexts
WahReferenceContextByHandle
WahCompleteRequest
WahNotifyAllProcesses
WahEnableNonIFSHandleSupport
WahCreateNotificationHandle
WahCreateSocketHandle
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahOpenHandleHelper
WahInsertHandleContext
WahDisableNonIFSHandleSupport
WahWaitForNotification
WahCloseThread
WahRemoveHandleContext
WahOpenNotificationHandleHelper
WahCreateHandleContextTable
WahOpenCurrentThread
WahOpenApcHelper
WahCloseHandleHelper
WahDestroyHandleContextTable
WahCloseApcHelper
WahQueueUserApc

msoeacct

GetDllMajorVersion
ValidEmailAddress
DllGetClassObject
DllCanUnloadNow
HrCreateAccountManager

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 759KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97fe52729992321fef3eec72f702d405

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

odbcjt32

msvcrt40

ws2help

msoeacct

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 276KB - Virtual size: 759KB

.tls Size: 512B - Virtual size: 4B

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 512B - Virtual size: 236B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 276KB - Virtual size: 759KB

.tls
Size: 512B - Virtual size: 4B

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 512B - Virtual size: 236B