f79204ac2889f7bb60d9a8117c6534c7_JaffaCakes118

General

Target

f79204ac2889f7bb60d9a8117c6534c7_JaffaCakes118
Size

40KB
MD5

f79204ac2889f7bb60d9a8117c6534c7
SHA1

ef770808e71e53ab56a7ef65b67ef39bd00784e1
SHA256

a0ee131ef784e271c8d3749de724def97bcff6ad7eca49d60601ace2db39fcdc
SHA512

0fc9cd9a1ab7e74d7f32472e4d7cc6f77c99554367afdb2be4c699c6b2f4321d8573e11240db5ef493a2926e235a92b60bdbe8183b7b8576546ed4e4bab6bb7b
SSDEEP

768:cX0LhHqybO/e7wdnKTGkRF5phdhZsF6Noq:m0LhHqKO/nKTGkv5ppmGo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f79204ac2889f7bb60d9a8117c6534c7_JaffaCakes118

Files

f79204ac2889f7bb60d9a8117c6534c7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b48d4f95b75d3b29bfe6a5d6b20bb1d0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
CopyFileA
lstrcatA
GetTickCount
GetLocalTime
lstrcpyA
GetComputerNameA
GetLocaleInfoA
MultiByteToWideChar
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
_lclose
_lopen
GetSystemDirectoryA
WideCharToMultiByte
GetModuleFileNameA
lstrlenA
CloseHandle
Sleep
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetStringTypeW
GetStringTypeA
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TlsAlloc
SetLastError
TlsGetValue
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA

ws2_32

gethostname
gethostbyname
send
socket
htons
inet_addr
ioctlsocket
connect
select
closesocket
WSAStartup
WSACleanup
inet_ntoa

mpr

WNetAddConnection2A
WNetCancelConnection2A

netapi32

NetApiBufferFree
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b48d4f95b75d3b29bfe6a5d6b20bb1d0

Headers

File Characteristics

Imports

kernel32

advapi32

ws2_32

mpr

netapi32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 11KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 11KB