JaffaCakes118_ab0ccf34a5baa58b51003748c4b2970c

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_ab0ccf34a5baa58b51003748c4b2970c
Size

43KB
MD5

ab0ccf34a5baa58b51003748c4b2970c
SHA1

bfcda08f29a46643d7826b40aaa755cfc3b9094a
SHA256

c995e4e5278b623f2af81ac077dd3a5ca97ae2488f54ec6516413eb049fab9c8
SHA512

82766bf4ee484f039eeea8de5fc1f1b84d9217acc8e64e4a3d0662140daff589a07124e42c647f190f436fe61337884113b95f65269aa1d5d780baea5b672412
SSDEEP

768:U35ND5lWxjbbx7u3GUiGzbA2u33/JtBTQ9sHqC/39N35AuKDnMpca:6/D7IB3GQ3t1isT9rAufca

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_ab0ccf34a5baa58b51003748c4b2970c

Files

JaffaCakes118_ab0ccf34a5baa58b51003748c4b2970c
.exe .vbs windows:5 windows x86 arch:x86 polyglot

966d3510d1b65b401e9a96d1393387d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrDupA
StrStrA

ws2_32

connect
gethostbyname
socket
WSAStartup
send
recv
htons
closesocket

rpcrt4

UuidToStringA
UuidCreate

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA

urlmon

URLDownloadToFileA

kernel32

GetLastError
SetErrorMode
CreateFileMappingA
GetStartupInfoA
ExpandEnvironmentStringsA
GetSystemDefaultLangID
VerLanguageNameA
GetEnvironmentVariableA
ExitProcess
GetModuleFileNameA
lstrcmpA
CreateDirectoryA
GetFileTime
lstrlenA
lstrcatA
lstrcpyA
GetFileAttributesA
CloseHandle
GetFileSize
CreateFileA
ReadFile
WriteFile
SetFilePointer
GetTempFileNameA
GetTickCount
GetTempPathA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateProcessA
Sleep
GetCurrentProcess
GetModuleHandleA
DeleteFileA
GetSystemDirectoryA
SetFileTime

user32

wsprintfA
GetDC

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA

shell32

SHGetPathFromIDListA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetMalloc

msvcrt

realloc
_controlfp
_except_handler3
__set_app_type
__p__fmode
strcmp
strlen
??3@YAXPAX@Z
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
memset
memcpy
memcmp
fopen
fprintf
vfprintf
fclose
sprintf
strrchr
strstr
malloc
free
memmove

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

966d3510d1b65b401e9a96d1393387d8

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

ws2_32

rpcrt4

wininet

urlmon

kernel32

user32

gdi32

advapi32

shell32

msvcrt

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 25KB - Virtual size: 32KB

.reloc Size: 1KB - Virtual size: 29KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 25KB - Virtual size: 32KB

.reloc
Size: 1KB - Virtual size: 29KB