fb7d6605ed4bf134db1d4caa27db2bbe_JaffaCakes118

General

Target

fb7d6605ed4bf134db1d4caa27db2bbe_JaffaCakes118
Size

15KB
MD5

fb7d6605ed4bf134db1d4caa27db2bbe
SHA1

f445c0fa35b68647d5a76a5592c2ebe37d1b7111
SHA256

392acb0b680df9b3ee872c2398a3d290bb582eb3923c4d61a315544de4063b07
SHA512

1844213130fe6adbdb6f383e6a631c7b69299c28dac71b66f18ab4e688bf6cf7b332d22cc13ec737d0416990f477c18b07eff12e0cf1921c32dfce220408f59d
SSDEEP

192:LsGAd9ZYxn2bQoveZf1ig5MIJfOQ+Dgpfm5i3JbRJ33yR6pitPrk+6tQPOXa/Ai8:YGRxZ9ijIJmX0fJny0G6tQPOXaIi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb7d6605ed4bf134db1d4caa27db2bbe_JaffaCakes118

Files

fb7d6605ed4bf134db1d4caa27db2bbe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bb46d6e9b500f642a107c39eaa519f79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Programación\MessageQueue\MQ_exploit\MessageQueue\MessageQueue.pdb

Imports

rpcrt4

NdrClientCall2
RpcStringFreeA
RpcBindingToStringBindingA
UuidToStringA
RpcMgmtEpEltInqNextA
RpcMgmtEpEltInqBegin
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcBindingFree

kernel32

InterlockedCompareExchange
Sleep
InterlockedExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetVersionExA
GetTickCount
QueryPerformanceCounter

ws2_32

send
connect
socket
htons
inet_addr
WSAStartup
recv

msvcr80d

_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_invoke_watson
malloc
free
exit
printf
fflush
__iob_func
strcpy
atoi
strlen
strchr
strcmp
sprintf
memset
memcpy
mbstowcs
wcslen
wcscat
memcmp
_except_handler4_common
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_amsg_exit
__getmainargs
_exit
_XcptFilter
_cexit
__initenv
_CrtSetCheckCount
_CrtDbgReportW
_initterm
_initterm_e
_controlfp_s

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bb46d6e9b500f642a107c39eaa519f79

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

ws2_32

msvcr80d

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 3KB