4052da0bb1386ee03a31f7f809dfa4ed_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4052da0bb1386ee03a31f7f809dfa4ed_JaffaCakes118
Size

79KB
MD5

4052da0bb1386ee03a31f7f809dfa4ed
SHA1

ff48a180b647cde0a37d6558c682c1d5e6ee7715
SHA256

69ac902bd202bf11d67bc7e996e80e09296e49ab783e2cff182563c6937d09dc
SHA512

0f27b32ce56bf79a06027a57cd23efdee81f70f445cd41ffb47790d9d6744556cdb7086b55960be6d58bc70725a50bb15c755350e13726d560b91516a14d9ed2
SSDEEP

1536:OZavIdLzl6KK++eL9DqfpoabxpxgSkYgxaLhEGoE1M93DoN:OZavIdnl8+1cxhbPLgxgc3DoN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4052da0bb1386ee03a31f7f809dfa4ed_JaffaCakes118

Files

4052da0bb1386ee03a31f7f809dfa4ed_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2accb0662a92731a16b616d3bf352e6f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\che\spambot\xbot_public\Release\xbot_public.pdb

Imports

kernel32

ReadFile
CreateFileA
lstrcatA
GetTempPathA
WriteFile
lstrlenA
lstrcpynA
lstrcpyA
GetTempFileNameA
DeleteFileA
GetFileSize
Sleep
lstrcmpA
InitializeCriticalSection
ExitThread
GetLastError
HeapReAlloc
HeapAlloc
CloseHandle
HeapFree
HeapCreate
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
GetLocalTime
GetExitCodeThread
TerminateThread
WaitForSingleObject
GetVersionExA
FreeLibraryAndExitThread
GetModuleHandleA
GlobalAlloc
CreateProcessA
GlobalFree
HeapDestroy
CreateThread
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
VirtualAlloc
VirtualFree
WideCharToMultiByte
GetStdHandle
GetCPInfo
ExitProcess
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
InterlockedExchange
VirtualQuery
SetLastError
GetProcAddress
TerminateProcess
GetCurrentProcess
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
GetACP
GetOEMCP

user32

wsprintfA

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA

urlmon

URLDownloadToFileA

iphlpapi

GetNetworkParams
GetBestInterface
GetAdaptersInfo

ws2_32

ntohs
ntohl
inet_addr
sendto
recvfrom
WSAGetLastError
shutdown
WSACleanup
socket
gethostbyname
htons
connect
send
select
__WSAFDIsSet
closesocket
recv
WSAStartup
setsockopt

winmm

timeGetTime

Exports

Exports

InitModule

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2accb0662a92731a16b616d3bf352e6f

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

urlmon

iphlpapi

ws2_32

winmm

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 56KB

.data Size: 4KB - Virtual size: 5KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 60KB - Virtual size: 56KB

.data
Size: 4KB - Virtual size: 5KB

.reloc
Size: 8KB - Virtual size: 5KB