2ea69f80cf7c7df25a8cb76b39d7b026_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2ea69f80cf7c7df25a8cb76b39d7b026_JaffaCakes118
Size

23KB
MD5

2ea69f80cf7c7df25a8cb76b39d7b026
SHA1

7557fc678a19a1be00bc5079e9938a998454c45f
SHA256

4bac159a6b975825fe98287a441a1a8c30ac3c4c534aed6c1e1b0679778e3da5
SHA512

40bfa1baab862ac006b7e61fb9ed5055997712e29c9119e16c28fd4ea784d455c90fa856aef4f9930699edc3b70e923c2499dbceecbb899b131efc0271ae07ce
SSDEEP

384:1+4r3hKTf0pHnW1nXc+OD+72p7n0+yWFX02vOKwz:bh8f9nM+OD+anFXp+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ea69f80cf7c7df25a8cb76b39d7b026_JaffaCakes118

Files

2ea69f80cf7c7df25a8cb76b39d7b026_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a119afc2f19044c6ce95dec000655814

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\CXR16\BSF\intel_a\code\bin\CATHttpTunnelServer.pdb

Imports

ws2_32

recv
gethostbyname

pychttptunnelcore

?debug_level@CATCommonUtil@@2HA
?debug_file@CATCommonUtil@@2PAU_iobuf@@A
?DoBind@CATCommonUtil@@SAHH@Z
??1CATConnectionHalf@@QAE@XZ
??0CATConnectionHalf@@QAE@XZ
?poll@@YAHPAUpollfd@@HH@Z
?DoClose@CATCommonUtil@@SAHAAH@Z
?Close@CATConnectionHalf@@QAEXXZ
?CheckStack@CATHttpTunnel@@QAEHXZ
?SendKeepAlive@CATHttpTunnel@@QAEHXZ
?IsClosed@CATConnectionHalf@@QAEHXZ
?DoAccept@CATCommonUtil@@SAHH@Z
?Setsockopt@CATCommonUtil@@SAHH@Z
?SetHttpSocket@CATHttpTunnel@@QAEHH@Z
?AcceptHttpProxy@CATHttpTunnel@@QAEHHH@Z
?Close@CATHttpTunnel@@QAEHXZ
?Accept@CATHttpTunnel@@QAEHPADAAH1@Z
?DoConnect@CATCommonUtil@@SAHPBDH@Z
?SetDestination@CATHttpTunnel@@QAEHPBDH@Z
?SetURL@CATHttpTunnel@@QAEHPBD@Z
?WriteHttpRequest@CATHttpTunnel@@QAEHXZ
?ReadHttpResponse@CATHttpTunnel@@QAEHXZ
?WriteHttpResponse@CATHttpTunnel@@QAEHXZ
?AcceptAck@CATHttpTunnel@@QAEHXZ
??0CATHttpTunnel@@QAE@ABV0@@Z
?SendAck@CATHttpTunnel@@QAEHXZ
?SendPoll@CATHttpTunnel@@QAEHXZ
??1CATHttpTunnel@@QAE@XZ
?Read@CATHttpTunnel@@QAEJPAXK@Z
?Write@CATCommonUtil@@SAJHPAXK@Z
?Print@CATCommonUtil@@SAXHPADZZ
?Dump@CATCommonUtil@@SAXPAEK@Z
??0CATHttpTunnel@@QAE@H@Z
?Write@CATHttpTunnel@@QAEJPAXK@Z
?Base64Encode@CATCommonUtil@@SAXPBDPAD@Z

kernel32

GetLocaleInfoA
GetThreadLocale
GetModuleHandleA
GetACP
InterlockedExchange
GetVersionExW

mfc70u

ord705
ord703

msvcr70

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
__p___initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
__p__fmode
_errno
strerror
memmove
time
__CxxFrameHandler
strstr
sprintf
atoi
fopen
strchr
_iob
fprintf
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
?terminate@@YAXXZ

oleaut32

SysFreeString

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.hhqg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a119afc2f19044c6ce95dec000655814

Headers

File Characteristics

PDB Paths

Imports

ws2_32

pychttptunnelcore

kernel32

mfc70u

msvcr70

oleaut32

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 880B

.hhqg Size: 4KB - Virtual size: 4KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 880B

.hhqg
Size: 4KB - Virtual size: 4KB