f8308fe72333c72d087c9223cf136b2c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f8308fe72333c72d087c9223cf136b2c_JaffaCakes118
Size

42KB
MD5

f8308fe72333c72d087c9223cf136b2c
SHA1

05d53f8fcf31f48922e53fcb3a746d8cb81f542f
SHA256

f546ee13cefc1a4e68045c05c2ed2784bffa75dd7bc3b2fbb5056049e4af51c4
SHA512

6a6b27a6512c65b2464bafa7442ca52a3e85fe0b4e470bd85e77733bb9b5078881e302a743fa942fcf31cb3894bb3a2da1895af12d8fe54531cebddecb598b2f
SSDEEP

768:vw/WIn3+NvtSet2YeOBIwy4aYHd1LDrd2nl3nWyGfbOKaEu0tkb:Y+IORteYIdQLdQGlfiKab0tkb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8308fe72333c72d087c9223cf136b2c_JaffaCakes118

Files

f8308fe72333c72d087c9223cf136b2c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

c40266bf28606bcd8243388fa126dfc2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTempPathA
FreeLibrary
LocalFree
MapViewOfFile
UnmapViewOfFile
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GlobalAlloc
InitializeCriticalSection
ReadFile
GetFileSize
SetFilePointer
WriteFile
CreateFileMappingA
CreateFileA
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
GetSystemTime
GetTickCount
GetSystemDirectoryA
DeviceIoControl
lstrcatW
GetSystemDirectoryW
lstrcmpiW
GetModuleFileNameW
IsBadWritePtr
LockResource
SizeofResource
LoadResource
FindResourceA
lstrlenW
lstrcpyW
CreateFileW
TerminateJobObject
AssignProcessToJobObject
CreateJobObjectA
LoadLibraryExA
Sleep
InterlockedExchange
RtlUnwind
lstrcpyA
MoveFileA
GlobalFree
OpenProcess
GetStartupInfoA
CreateProcessA
CloseHandle
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetCurrentThreadId
CreateEventA
GetLastError
CreateThread
LoadLibraryW
GetProcAddress
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
lstrcatA
ExitProcess
VirtualQuery

user32

wsprintfW
wsprintfA
GetInputState
PeekMessageA
PostThreadMessageA

advapi32

ControlService
CreateServiceA
RegQueryValueExA
OpenSCManagerA
OpenServiceA
StartServiceA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerW
DeleteService

ws2_32

htons
socket
connect
inet_ntoa
gethostbyname
gethostname
WSAStartup
send
closesocket
inet_addr

Exports

Exports

ServiceMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c40266bf28606bcd8243388fa126dfc2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 2KB - Virtual size: 1KB