fc823913f9e63ed4b4c8985c82fda841_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc823913f9e63ed4b4c8985c82fda841_JaffaCakes118
Size

521KB
MD5

fc823913f9e63ed4b4c8985c82fda841
SHA1

82613a9098f6f2eb3db3e56f09951979b7a5b120
SHA256

fc50a7eadc3a6e182582ecf75e3ef389a7600978ef8a14781db50de1a1229836
SHA512

461aa0f80158913b35127c73e1a462b07d16b2a5f1e4940931059212a494348a32ebe50224bab8bd88abb29511442f3aa5850ac60b6bcb95bd1ec2f4f87ebcf5
SSDEEP

12288:qGOJA7OIVPJI9/QbwqC5WYgeWYg955/155/fYodaUjd:qVJ7IVPJIxQbdCoYmaU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc823913f9e63ed4b4c8985c82fda841_JaffaCakes118

Files

fc823913f9e63ed4b4c8985c82fda841_JaffaCakes118
.dll windows:6 windows x64 arch:x64

eae4cafcf4155c9faf81cf6d524852b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\malid\source\repos\HiveWorkstation\client\x64\Release\app.pdb

Imports

kernel32

CreateThread
CloseHandle
LoadLibraryA
GetProcAddress
Sleep
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetModuleFileNameA
ExpandEnvironmentStringsA
InitializeCriticalSectionEx
CreateMutexA
WaitForSingleObject
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
OpenEventA
SetEvent
CreateEventA
GetCurrentThreadId
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LocalFree
MultiByteToWideChar
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
GetModuleHandleW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
OutputDebugStringW
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW

user32

UnregisterClassA
AddClipboardFormatListener
SetClipboardData
RemoveClipboardFormatListener
GetClipboardData
TranslateMessage
CreateWindowExA
EmptyClipboard
CloseClipboard
SetTimer
DispatchMessageW
KillTimer
DestroyWindow
DefWindowProcW
GetMessageW
CharLowerA
FindWindowA
OpenClipboard
GetWindowThreadProcessId
CallNextHookEx
PostThreadMessageA
RegisterClassExA

ole32

CoCreateGuid
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoInitializeEx

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

Exports

Exports

LicenseManager
QueryLicenses

Sections

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eae4cafcf4155c9faf81cf6d524852b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 360KB

.rdata Size: 126KB - Virtual size: 125KB

.data Size: 11KB - Virtual size: 25KB

.pdata Size: 17KB - Virtual size: 17KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 360KB - Virtual size: 360KB

.rdata
Size: 126KB - Virtual size: 125KB

.data
Size: 11KB - Virtual size: 25KB

.pdata
Size: 17KB - Virtual size: 17KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 4KB - Virtual size: 3KB