JaffaCakes118_6c408ef29ef61edecac89c83fe0e4674

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_6c408ef29ef61edecac89c83fe0e4674
Size

296KB
MD5

6c408ef29ef61edecac89c83fe0e4674
SHA1

bd1359db240511a744473f39a922d37f7bfd61c7
SHA256

61788cb6a51c64211dbf769e1403e71c3506f3e8b359521ff43a59041c3ca591
SHA512

c986508506a7e1518ec9d9d99fca9a0991d050db3e3a67d9923a2ae34c21f73ce64feaa08401ebcb86d8648f0982c64be82b9f160cda95f00f04ae4a6e5bf598
SSDEEP

3072:vyOOdzt7SJuKLGcJabSfO1M1LpCEVS+5Dbja0FtTKoX3457nDR4tIhKjqhWxvqu:xOnOJuABJabKMwNCl+5Llsh6tTA4Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6c408ef29ef61edecac89c83fe0e4674

Files

JaffaCakes118_6c408ef29ef61edecac89c83fe0e4674
.dll windows:4 windows x86 arch:x86

275e09ee4171cd050dd5ac2fd0580975

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAJoinLeaf
WSAAccept
WSARecv
WSASend
WSAGetOverlappedResult
WSARecvFrom
WSASendTo
WSASocketW
WSASocketA
inet_addr
htonl
WSAGetLastError
ioctlsocket
WSAConnect
gethostname
select
getpeername
getsockname
bind
getsockopt
setsockopt
accept
listen
closesocket
sendto
send
recvfrom
recv
connect
socket
WSAStartup
ntohl
inet_ntoa
htons
ntohs

mswsock

AcceptEx
WSARecvEx
GetAcceptExSockaddrs

kernel32

VirtualQuery
LoadLibraryA
LoadLibraryExA
IsBadReadPtr
FreeLibrary
WriteFile
SetFilePointer
CreateEventA
SetEvent
lstrcmpiA
lstrcpynA
lstrcmpA
VirtualFree
VirtualAlloc
GetStdHandle
SetLastError
FlushInstructionCache
CreateRemoteThread
VirtualProtectEx
WriteProcessMemory
SetThreadContext
GetThreadContext
TerminateThread
GetExitCodeThread
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
GlobalLock
InterlockedIncrement
InterlockedDecrement
LocalFree
LocalAlloc
TlsAlloc
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcatA
GetVersion
SetErrorMode
GlobalFlags
WritePrivateProfileStringA
GetProcessVersion
FlushFileBuffers
GetSystemInfo
GetCPInfo
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
SetStdHandle
GetFileType
GetCommandLineA
ExitProcess
ExitThread
RaiseException
HeapSize
HeapReAlloc
GetACP
LCMapStringA
LCMapStringW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
Module32First
Module32Next
GetCurrentProcess
CreateThread
SetThreadPriority
CreateToolhelp32Snapshot
OpenProcess
GetExitCodeProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
SuspendThread
MultiByteToWideChar
ResumeThread
GetLastError
GetModuleFileNameA
GetVersionExA
Sleep
OpenMutexA
GetTickCount
ReleaseMutex
CloseHandle
GlobalFree
DeleteCriticalSection
CreateMutexA
InitializeCriticalSection
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection
WideCharToMultiByte
WaitForSingleObject
CreateProcessW
CreateProcessA
lstrlenA
lstrcpyA
VirtualProtect
VirtualAllocEx

user32

ClientToScreen
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetSystemMetrics
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetWindowPos
SetWindowLongA
GetWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
DestroyWindow
GetDlgCtrlID
GetWindowTextA
GetDlgItem
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
LoadIconA
ShowWindow
UnregisterClassA
GetClassNameA
PtInRect
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
EnableWindow
wsprintfA
GetClassInfoA
DefWindowProcA
PostThreadMessageA
CreateWindowExA
SetForegroundWindow
MessageBoxA
PostQuitMessage
SetTimer
SetWindowTextA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
KillTimer
WaitMessage
GetMenuCheckMarkDimensions

gdi32

DeleteDC
GetDeviceCaps
GetObjectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SaveDC
RestoreDC
SelectObject
GetStockObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
DeleteObject
CreateBitmap

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

comctl32

ord17

ole32

CoGetClassObject
CoCreateInstance

imagehlp

ImageDirectoryEntryToData

wsock32

WSAAsyncSelect
shutdown
WSACleanup
WSASetLastError
gethostbyname

winmm

timeKillEvent
timeSetEvent

Exports

Exports

FNS_AddHost
FNS_EmptyHost
FNS_GameBegin
FNS_GameEnd
FNS_GetDPlaySvrHandle
FNS_GetGamePlayState
FNS_GetLocalGamePort
FNS_GetVersion
FNS_ModifyPlayFlag
FNS_ModifyProxyIp
FNS_ModifySwitchPort
FNS_RemoveHost
FNS_SetCurrentPath
FNS_SetDPlaySvrHandle
FNS_SetData
FNS_SetDataCallbackFunc
FNS_SetGameParam
FNS_SetGamePlayState
FNS_SetGameProcessName
FNS_SetInSameWall
FNS_SetLocalHostInfo
FNS_SetNetCtrlFlag
FNS_SetProxy
FNS_SetRemovedSocket
FNS_SetRoomInfo
FNS_SetSwitchInfo

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

275e09ee4171cd050dd5ac2fd0580975

Headers

File Characteristics

Imports

ws2_32

mswsock

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ole32

imagehlp

wsock32

winmm

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 143KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 16KB - Virtual size: 43KB

Shared Size: 16KB - Virtual size: 14KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 20KB - Virtual size: 18KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 144KB - Virtual size: 143KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 16KB - Virtual size: 43KB

Shared
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 20KB - Virtual size: 18KB

.rmnet
Size: 60KB - Virtual size: 60KB