39d1dbcfa411c482f25b0c491fe1717e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

39d1dbcfa411c482f25b0c491fe1717e_JaffaCakes118
Size

26KB
MD5

39d1dbcfa411c482f25b0c491fe1717e
SHA1

7c7e08a9e50d55723961b386cd7290e6ad339fc7
SHA256

1db968360cccf8bd9aec6d704fb3354a74eefd1610656bf816f9edf44bee6d19
SHA512

493fd256e3aaa04e40084ed61c6086519e0f38bd28c6863ea4e8c194da3a3a20adbcf9f0139aece8aaeba1c824611a9fa3f12551c15e3d170b068f05d9d43f8d
SSDEEP

768:fmMmcp2NjAJE947lqTFzkhsD5SpX+pJk:E22pAu9MKFzSpX+pJk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39d1dbcfa411c482f25b0c491fe1717e_JaffaCakes118

Files

39d1dbcfa411c482f25b0c491fe1717e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

41f379904ba144978512de92ae2993b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
htonl
sendto
inet_addr
WSAGetLastError
WSAAsyncSelect
WSAStartup
getprotobyname
socket
gethostbyname
setsockopt
htons
connect
send
recv
closesocket
WSACleanup

kernel32

TerminateProcess
ResumeThread
SetThreadContext
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualProtectEx
VirtualAllocEx
VirtualAlloc
lstrcatA
HeapFree
CreateProcessA
GetProcessHeap
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA
GetTickCount
SetPriorityClass
GetCurrentProcess
CloseHandle
CreateMutexA
CreateThread
ExitProcess
GetCommandLineA
GetModuleFileNameA
Sleep
FreeLibrary
LoadLibraryA
DeleteFileA
SetFileAttributesA
GetThreadContext
GetFileAttributesA
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
ReadProcessMemory
VirtualQueryEx
GetStartupInfoA
HeapAlloc
MoveFileA

user32

ExitWindowsEx
PostQuitMessage
RegisterClassA
CreateWindowExA
DefWindowProcA
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
PostThreadMessageA
GetInputState
ShowWindow

advapi32

GetFileSecurityA
InitializeSecurityDescriptor
RegDeleteKeyA
RegOpenKeyA
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
AddAce
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
LookupAccountNameA
GetUserNameA
RegCloseKey
RegCreateKeyA
RegSetValueA
RegSetValueExA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

netapi32

NetUserGetLocalGroups
NetApiBufferFree

msvcrt

ftell
fseek
fclose
fopen
_except_handler3
_itoa
rand
strstr
atoi
strncpy
strcspn
__CxxFrameHandler
malloc
_strlwr
sprintf
fread

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

41f379904ba144978512de92ae2993b4

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

msvcp60

netapi32

msvcrt

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 2KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 2KB - Virtual size: 2KB