JaffaCakes118_e2afd20aff8326eba2fe1adf877e697b

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_e2afd20aff8326eba2fe1adf877e697b
Size

5.0MB
MD5

e2afd20aff8326eba2fe1adf877e697b
SHA1

75ca47a7aee5022861f6de979ba00cc900a12e5a
SHA256

235ff13a5b3ce7f82840b1b24497222d9090b13bfc6b4844ce3ad4b98bdd488e
SHA512

775fadd0dd80e6a39103dfa42ccd3d01c111b2437e6384150e06e12210e82d4312f879736192515a762f4d3a4769e298a0128af5c21999e2ead0f5c9f62e2e7f
SSDEEP

98304:jG0SCRlf3RHDxjwuSJjMtKVxWfIcR7plKm3tiJxMOgetpykOaiwktYvcpL4uOR:jG0SCRlf3RHFjwuSJjMtK3WflR7plKm+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_e2afd20aff8326eba2fe1adf877e697b

Files

JaffaCakes118_e2afd20aff8326eba2fe1adf877e697b
.exe windows:4 windows x86 arch:x86

1197dba971519f4260fea310928a80d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

libgmp-3

__gmpz_add
__gmpz_clear
__gmpz_export
__gmpz_import
__gmpz_init2
__gmpz_invert
__gmpz_mod
__gmpz_mul
__gmpz_powm
__gmpz_set
__gmpz_set_str
__gmpz_set_ui
__gmpz_sizeinbase
__gmpz_sub
__gmpz_sub_ui

kernel32

CloseHandle
CopyFileA
CopyFileW
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateWaitableTimerA
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageA
FreeLibrary
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetQueuedCompletionStatus
GetShortPathNameW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadTimes
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MoveFileA
MoveFileW
MultiByteToWideChar
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryA
RemoveDirectoryW
ResetEvent
ResumeThread
SetConsoleTitleA
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEvent
SetFileTime
SetLastError
SetPriorityClass
SetProcessAffinityMask
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

_fdopen
_fstat
_lseek
_read
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_atoi64
_beginthreadex
_cexit
_errno
_filbuf
_flsbuf
_ftime
_iob
_isctype
_onexit
_pclose
_pctype
_popen
_setjmp
_setmode
_stricmp
_strnicmp
abort
acos
asin
atan
atan2
atexit
atof
atoi
ceil
clearerr
clock
cos
cosh
ctime
difftime
exit
exp
fclose
fflush
fgetc
fgets
floor
fmod
fopen
fprintf
fputc
fputs
fread
free
freopen
frexp
fscanf
fseek
ftell
fwrite
getenv
getwc
gmtime
isalpha
iswctype
ldexp
localeconv
localtime
log
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
modf
pow
puts
putwc
rand
realloc
remove
rename
setlocale
setvbuf
signal
sin
sinh
sprintf
sqrt
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtoul
strxfrm
system
tan
tanh
time
tmpfile
tmpnam
tolower
toupper
towlower
towupper
ungetc
ungetwc
wcscoll
wcsftime
wcslen
wcsxfrm

libmysql

mysql_insert_id
mysql_fetch_row
mysql_close
mysql_commit
mysql_rollback
mysql_fetch_lengths
mysql_free_result
mysql_real_query
mysql_store_result
mysql_fetch_field
mysql_real_escape_string
mysql_ping
mysql_init
mysql_options
mysql_real_connect
mysql_errno
mysql_error
mysql_get_client_version

libsqlite3-0

sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_count
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_text
sqlite3_errmsg
sqlite3_finalize
sqlite3_last_insert_rowid
sqlite3_open
sqlite3_prepare_v2
sqlite3_snprintf
sqlite3_step

ws2_32

WSAAddressToStringA
WSARecv
WSASend
WSASocketA

wsock32

AcceptEx
GetAcceptExSockaddrs
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
bind
closesocket
gethostbyname
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
listen
ntohl
recv
send
setsockopt
shutdown

libxml2

xmlParseFile
xmlDocGetRootElement
xmlStrcmp
xmlFreeDoc
xmlNewDoc
xmlNewDocNode
xmlNodeSetContent
xmlNewNode
xmlSetProp
xmlAddChild
xmlNewTextChild
xmlDocDumpMemory
UTF8Toisolat1
xmlNodeGetContent
xmlGetProp
xmlGetLastError

libgcc_s_dw2-1

_Unwind_DeleteException
_Unwind_GetDataRelBase
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__deregister_frame_info
__divdi3
__emutls_get_address
__fixunsdfdi
__fixunssfdi
__moddi3
__powisf2
__register_frame_info
__udivdi3
__umoddi3

Exports

Exports

luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlevel
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 90KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1197dba971519f4260fea310928a80d4

Headers

File Characteristics

Imports

advapi32

libgmp-3

kernel32

msvcrt

libmysql

libsqlite3-0

ws2_32

wsock32

libxml2

libgcc_s_dw2-1

Exports

Exports

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.data Size: 29KB - Virtual size: 29KB

.rdata Size: 1.1MB - Virtual size: 1.1MB

/4 Size: 1024B - Virtual size: 912B

.bss Size: - Virtual size: 90KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 10KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 12B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 820B

.reloc Size: 212KB - Virtual size: 211KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.data
Size: 29KB - Virtual size: 29KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

/4
Size: 1024B - Virtual size: 912B

.bss
Size: - Virtual size: 90KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 10KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 12B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 820B

.reloc
Size: 212KB - Virtual size: 211KB