2b215ac11a603b096978c2aa96497712_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b215ac11a603b096978c2aa96497712_JaffaCakes118
Size

59KB
MD5

2b215ac11a603b096978c2aa96497712
SHA1

5dfd277b796cafc1652e72dd521b83d6461d4e6e
SHA256

10a15a05b0362214ebec2b44ae3e742983a4a2b7b4bec1f44dccb62e056d4537
SHA512

f207ab22c57bfd65819b0c1db757a5321e107f7830fe072dc3243af7d487fa73b1c068d94da0615032b387121ae8589bf5839cfb568785aaa8396b0915fe6c22
SSDEEP

768:aGkMkgLPrxBTra+0s9V5dCFpI0ndAidRbqoinFSVmYGbeuIVyT3CKqpz0GSgf9t:aGkMkgfxBTrj+lelbe9y7CKq6GSgf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b215ac11a603b096978c2aa96497712_JaffaCakes118

Files

2b215ac11a603b096978c2aa96497712_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a9dfa391673ac79d0edbe1f0a2a558b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp60

??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAG@Z
?id@?$messages@G@std@@2V0locale@2@A
?pow@std@@YA?AV?$complex@M@1@ABV21@ABM@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?frac_digits@?$_Mpunct@D@std@@QBEHXZ
?sync_with_stdio@ios_base@std@@SA_N_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
??0?$ctype@G@std@@QAE@I@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??Hstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
??Dstd@@YA?AV?$complex@O@0@ABV10@0@Z
??_F?$moneypunct@G$0A@@std@@QAEXXZ
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?underflow@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?round_error@?$numeric_limits@G@std@@SAGXZ
?imag@?$_Complex_base@M@std@@QBEMXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?cos@std@@YA?AV?$complex@N@1@ABV21@@Z
??_F?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
wctrans
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z

user32

HideCaret
BlockInput
CopyAcceleratorTableW
GetClassInfoA
IsCharLowerA
GetClipboardData
CountClipboardFormats
DrawIconEx
SetProgmanWindow
CascadeChildWindows
PostMessageA
LockSetForegroundWindow
SetDlgItemInt
CreateIcon
EndMenu
LoadAcceleratorsW
GetMenuBarInfo
GetClipCursor
DdeAccessData
GetReasonTitleFromReasonCode
GetMenuState

kernel32

GetCurrentDirectoryW
SetPriorityClass
GetModuleFileNameW
HeapCreate
GetFileAttributesW
LCMapStringW
SetCalendarInfoW
SetHandleContext
GetModuleHandleW
VerLanguageNameA
Thread32Next
LoadLibraryA
FindFirstFileExW
Module32First
ResetEvent
EnumSystemCodePagesW
GetVDMCurrentDirectories
GetModuleHandleExW
GetEnvironmentStringsW
lstrcpyA
FindActCtxSectionStringA
HeapReAlloc
GetProcessTimes
DosDateTimeToFileTime
WaitNamedPipeA
RemoveDirectoryW
EnumCalendarInfoExW
Module32Next
GlobalFix
VirtualAlloc
GetPriorityClass

msdart

?sm_llGlobalList@CLKRLinearHashTable@@0VCLockedDoubleList@@A
?ConvertSharedToExclusive@CReaderWriterLock3@@QAEXXZ
?_Expand@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@XZ
?IsMillnm@CMdVersionInfo@@SAHXZ
FXMemDetach
?ReadUnlock@CCritSec@@QAEXXZ
?SetDefaultSpinCount@CCritSec@@SGXG@Z
?ReadLock@CReaderWriterLock2@@QAEXXZ
MpHeapSize
??1CCritSec@@QAE@XZ
?_CalcKeyHash@CLKRHashTable@@ABEKK@Z
??4CReaderWriterLock@@QAEAAV0@ABV0@@Z
?GetSpinCount@CFakeLock@@QBEGXZ
?IsValid@CLKRLinearHashTable@@QBE_NXZ
MpGetHeapHandle
?RemoveHead@CLockedDoubleList@@QAEQAVCListEntry@@XZ
?IsWriteUnlocked@CLKRLinearHashTable@@QBE_NXZ
?TryWriteLock@CReaderWriterLock@@QAE_NXZ
?_ExtractKey@CLKRLinearHashTable@@ABE?BKPBX@Z
?_LockSpin@CReaderWriterLock@@AAEX_N@Z
?InitializeVersionInfo@CMdVersionInfo@@CAHXZ
??0CLockedSingleList@@QAE@XZ
?GetDefaultSpinAdjustmentFactor@CSpinLock@@SGNXZ
?IsUsable@CLKRHashTable@@QBE_NXZ
??0CCritSec@@QAE@XZ
?sm_dblDfltSpinAdjFctr@CReaderWriterLock2@@1NA

ws2_32

WSASetLastError
ntohl
WSAAsyncGetHostByName
WSALookupServiceNextW
getsockopt
WSAProviderConfigChange
WSASetEvent
WSADuplicateSocketA
WSAAsyncGetServByName
WSAEnumNameSpaceProvidersA
WSCEnableNSProvider
WSASendDisconnect
WSAEventSelect
gethostbyname
WSAGetServiceClassNameByClassIdA
sendto
gethostname
WSANtohl
getsockname
bind
WSAAsyncGetServByPort
WSAEnumNameSpaceProvidersW
WSAGetQOSByName
recv

wship6

WSHGetWinsockMapping
WSHGetWildcardSockaddr
WSHNotify
WSHGetSockaddrType
WSHIoctl
WSHOpenSocket
WSHSetSocketInformation
WSHJoinLeaf
WSHGetSocketInformation
WSHOpenSocket2
WSHStringToAddress
WSHEnumProtocols
WSHGetProviderGuid
WSHAddressToString
WSHGetWSAProtocolInfo

advapi32

OpenServiceW
SystemFunction001
ObjectCloseAuditAlarmA
LsaQueryForestTrustInformation
RegQueryInfoKeyA
GetAuditedPermissionsFromAclW
LsaSetInformationPolicy
CryptEncrypt
SetSecurityDescriptorSacl
IdentifyCodeAuthzLevelW
LookupSecurityDescriptorPartsA
UninstallApplication
CredWriteDomainCredentialsW
BuildImpersonateTrusteeA
CredReadDomainCredentialsW
OpenEventLogA
EncryptedFileKeyInfo
LsaFreeMemory
StartServiceCtrlDispatcherW
LsaEnumerateTrustedDomainsEx
I_ScSetServiceBitsA
WmiExecuteMethodW
QueryAllTracesW
CredEnumerateW
WmiNotificationRegistrationW
ConvertStringSidToSidA
DestroyPrivateObjectSecurity
LsaRemoveAccountRights
SaferiCompareTokenLevels
SetPrivateObjectSecurityEx

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9dfa391673ac79d0edbe1f0a2a558b5

Headers

DLL Characteristics

File Characteristics

Imports

msvcp60

user32

kernel32

msdart

ws2_32

wship6

advapi32

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 17KB - Virtual size: 57KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 240B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 17KB - Virtual size: 57KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 240B