JaffaCakes118_48a4f684b084ec09e30d870b70432470

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_48a4f684b084ec09e30d870b70432470
Size

672KB
MD5

48a4f684b084ec09e30d870b70432470
SHA1

d7fba07ab184a92f194abb36079ab8b06cefa647
SHA256

0746e8ae76482656bc68df6630e036052e50e8722218f5eacda416b7dcaf929b
SHA512

31cd8e42d0f60b49dd9c10d4e1d16c44121a4f733bc2e8784d9f83efc4887d689cd379a6facc7de140d8aa731d46265fd8b7ef71ba18a0d535d4caa8371c8534
SSDEEP

12288:EpdtrLvqMAMwX/AUWIN3IG40IKhTZDpOr7OTAax6p3uW/2:SeMFwPAUPq2TVpOr7wADP/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_48a4f684b084ec09e30d870b70432470

Files

JaffaCakes118_48a4f684b084ec09e30d870b70432470
.dll windows:4 windows x86 arch:x86

f3ac81d3f19dc020e6b4f8b0742d9aa7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\curl-7.13.0\lib\libcurl.pdb

Imports

wsock32

__WSAFDIsSet
connect
setsockopt
getsockopt
inet_ntoa
recv
inet_addr
WSASetLastError
htons
select
WSAGetLastError
send
WSAStartup
gethostname
htonl
WSACleanup
ioctlsocket
socket
shutdown
bind
ntohs
listen
getsockname
accept
closesocket

winmm

timeGetTime

gdi32

CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateDCA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA

kernel32

InitializeCriticalSection
CreateFileA
InterlockedExchange
GetOEMCP
CompareStringA
RtlUnwind
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
HeapSize
FlushConsoleInputBuffer
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
GetACP
HeapAlloc
LoadLibraryA
FreeLibrary
GetProcAddress
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
GetLastError
ExpandEnvironmentStringsA
SleepEx
FormatMessageA
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
CloseHandle
GetVersionExA
GetCurrentThreadId
SetLastError
FindClose
FindFirstFileA
GetWindowsDirectoryA
GetVersion
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
GetTimeFormatA
GetDateFormatA
SetFilePointer
GetFileInformationByHandle
HeapReAlloc
HeapFree
GetCommandLineA
ExitProcess
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
GetFullPathNameA
GetCurrentDirectoryA
WideCharToMultiByte
GetTimeZoneInformation
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
WriteFile
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetStdHandle
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
SetConsoleCtrlHandler
GetStringTypeA
GetStringTypeW
GetCPInfo
GetLocaleInfoA

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_reset
curl_easy_setopt
curl_easy_strerror
curl_escape
curl_formadd
curl_formfree
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_strerror
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 384KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f3ac81d3f19dc020e6b4f8b0742d9aa7

Headers

File Characteristics

PDB Paths

Imports

wsock32

winmm

gdi32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 384KB - Virtual size: 380KB

.rdata Size: 132KB - Virtual size: 128KB

.data Size: 56KB - Virtual size: 68KB

.rsrc Size: 4KB - Virtual size: 992B

.reloc Size: 32KB - Virtual size: 31KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 384KB - Virtual size: 380KB

.rdata
Size: 132KB - Virtual size: 128KB

.data
Size: 56KB - Virtual size: 68KB

.rsrc
Size: 4KB - Virtual size: 992B

.reloc
Size: 32KB - Virtual size: 31KB

.rmnet
Size: 60KB - Virtual size: 60KB