4cced73818adaf8a4205b45eba5bb172_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4cced73818adaf8a4205b45eba5bb172_JaffaCakes118
Size

101KB
MD5

4cced73818adaf8a4205b45eba5bb172
SHA1

4e04d8eaf086582bd25ff8873e25490e0a7ee9fe
SHA256

5991c7b05fb9a6dc62f65b13051ffb4c019280c16a931bc91b2604d18776bea7
SHA512

e599848a5bb1171616286e0ba61e91cdd2b79696c293dc7fc5a34d785ba3f527d883e8375a5fea0c993bd5299715da2e741dc7a97557e7d23fc00630804273f4
SSDEEP

1536:9ht2SPimywrf3rM301PUHBoumwBHk/I98XlczxsWjcdsjRz4Qi6OB:v0EAwrf3rJgBCI+sjRz4Qi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cced73818adaf8a4205b45eba5bb172_JaffaCakes118

Files

4cced73818adaf8a4205b45eba5bb172_JaffaCakes118
.exe windows:5 windows x86 arch:x86

80fb2790e9ecb057297eb180d0b53337

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\大象哥\Desktop\5255\Server\Release\Server.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
Sleep
RaiseException
GetLastError
DecodePointer
DeleteCriticalSection
CloseHandle
CreateThread
FreeLibrary
WaitForSingleObject
GetProcAddress
LoadLibraryA
CreateMutexA
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
OutputDebugStringW
LCMapStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
RtlUnwind
HeapFree
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetProcessHeap
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
HeapAlloc
GetStdHandle
GetFileType
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
CreateFileW

ws2_32

select
WSAStartup
__WSAFDIsSet
gethostbyname
connect
inet_addr
htons
setsockopt
socket
closesocket
send
WSAIoctl
recv

wininet

InternetOpenA
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80fb2790e9ecb057297eb180d0b53337

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

wininet

Sections

.text Size: 62KB - Virtual size: 62KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 62KB - Virtual size: 62KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 4KB