0234db76a9f872540e95f918ae7c9221_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0234db76a9f872540e95f918ae7c9221_JaffaCakes118
Size

2.0MB
MD5

0234db76a9f872540e95f918ae7c9221
SHA1

0e7cdc37cdc9d37d91c8058b9eb7e01f59622173
SHA256

05bfc13d481d50a5f17cfe8abb1d750a3acc97d0260f1d94d81b3ab1b2ba5050
SHA512

d701adf7c76afd47867a38eaad1fefa45b4c9f6062c350e78ba32fe8bc0c5d63a99e4e0fc94945de28739fed37787af4e88d563c6c4824535591258a2b7e6bd0
SSDEEP

24576:hnrv/odmWuoIITWnrv/odmWuoccm/eRrsu7C361tT45/:hnrvKDhTWnrvKDetWRAue3mTo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0234db76a9f872540e95f918ae7c9221_JaffaCakes118

Files

0234db76a9f872540e95f918ae7c9221_JaffaCakes118
.exe windows:5 windows x64 arch:x64

2acb2511296637c6cc43214ba2aebf97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u251\737\build\windows-amd64\deploy\jre-image\bin\javaws.pdb

Imports

kernel32

WideCharToMultiByte
GetCurrentProcessId
LoadLibraryW
GetModuleHandleW
FreeLibrary
GetProcAddress
GetTickCount
CreateEventW
CloseHandle
WaitForSingleObject
GetThreadLocale
CreateDirectoryW
GetSystemWindowsDirectoryW
FindClose
FindFirstFileW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
GlobalMemoryStatusEx
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
GetCurrentProcess
GetNativeSystemInfo
GlobalFree
LocalFree
GlobalAlloc
GetLastError
CreateFileW
GetSystemDirectoryW
CreateProcessW
lstrlenW
GetEnvironmentVariableW
GetWindowsDirectoryW
LocalAlloc
FormatMessageW
WTSGetActiveConsoleSessionId
GetLongPathNameW
GetShortPathNameW
GetTempPathW
GetLocalTime
OutputDebugStringW
GetCurrentThreadId
GetModuleHandleExW
GetExitCodeProcess
GetFileAttributesW
lstrlenA
HeapSize
WriteConsoleW
CompareStringW
LCMapStringW
QueryPerformanceCounter
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
ReadFile
GetProcessHeap
SetEndOfFile
SetFilePointer
SetStdHandle
SetHandleCount
GetLocaleInfoW
Sleep
SetEnvironmentVariableW
SetEnvironmentVariableA
FlsAlloc
SetLastError
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
DeleteCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
RaiseException
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
HeapReAlloc
GetStringTypeW
ExitProcess
DecodePointer
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
GetFileType
MultiByteToWideChar
RtlLookupFunctionEntry
GetDateFormatW
GetTimeFormatW
GetTimeZoneInformation
RtlPcToFileHeader
GetCommandLineW
GetStartupInfoW
GetFullPathNameW
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
TerminateProcess
InitializeCriticalSectionAndSpinCount
WriteFile
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate

user32

MessageBoxW
DefWindowProcW
GetMessageW
DispatchMessageW
TranslateMessage
SetTimer
CreateWindowExW
RegisterClassW
LoadCursorW
wsprintfW
CloseDesktop
OpenInputDesktop
GetWindowThreadProcessId
GetShellWindow

ole32

StringFromCLSID
CoTaskMemFree

oleaut32

VariantClear
SysFreeString
SysAllocString
SysStringLen
SysAllocStringByteLen

wsock32

WSAStartup
WSAGetLastError
send
connect
htons
ioctlsocket
socket
recv
accept
ntohs
listen
getsockname
closesocket
WSAAsyncSelect
bind

Sections

.text
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2acb2511296637c6cc43214ba2aebf97

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

wsock32

Sections

.text Size: 210KB - Virtual size: 209KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 39KB - Virtual size: 132KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 210KB - Virtual size: 209KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 39KB - Virtual size: 132KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 3KB - Virtual size: 3KB