f3a29fc3acc93b794a523ca782bb4efe_JaffaCakes118

General

Target

f3a29fc3acc93b794a523ca782bb4efe_JaffaCakes118
Size

56KB
MD5

f3a29fc3acc93b794a523ca782bb4efe
SHA1

d902b8d27ef196f6d3e0ff57ad501ef32ace4445
SHA256

62021aef6965a8359347d547b5bfeb141e0a87e474201749ac89c3d328784829
SHA512

4740601886d981dfe7428a40e0fd26da42d846b2dc82d6deecb1f0d5a96fcbcb0db55498adbf2bd1d987f5384e870c69537344dc68024479a6e2e58c6f7e3ba1
SSDEEP

768:c2K0pDjAMfg36lrmD3e55Io1TZqNZsYmHZrc9ZAWUMgl0u:c21pgMfgK5HIo1TINBmHiAhdl0u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3a29fc3acc93b794a523ca782bb4efe_JaffaCakes118

Files

f3a29fc3acc93b794a523ca782bb4efe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0d5cc2c47e95b257edd37809e220619e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CloseHandle
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
OpenProcess
VirtualQuery
GetTickCount
GetSystemDirectoryA
GetVolumeInformationA
SetCurrentDirectoryA
GetModuleFileNameA
GetCurrentProcessId
CreateThread
LCMapStringW
LCMapStringA
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
WriteFile
ReadFile
InitializeCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileA
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
MultiByteToWideChar

user32

TranslateMessage
GetMessageA
GetWindowThreadProcessId
SendMessageA
FindWindowExA
FindWindowA
DispatchMessageA

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA

ws2_32

inet_addr
htons
recv
closesocket
inet_ntoa
gethostbyname
socket
WSAStartup
send
sendto
gethostname
connect

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0d5cc2c47e95b257edd37809e220619e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 12KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 12KB