a1c50b09db02d63ac7d1720efff313f0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a1c50b09db02d63ac7d1720efff313f0_JaffaCakes118
Size

448KB
MD5

a1c50b09db02d63ac7d1720efff313f0
SHA1

b18653c1e46ac27966658f82900a05f84b01c353
SHA256

8a72ef5a658bc0a7db62d3297ae7f4ca53d081dda4643b8dc43f00d6de24ea62
SHA512

279653db391fd957bb87eaa3b69f5b1e1a0c574225db58dadd14bb0e6c79baa4f2731ded0fe69f849517259701b1c0fbec724d79318fcb9fab9bf2c30d0fad78
SSDEEP

6144:1Q1HzOjqAxYAgL7EPzdNfFJM8QA0iL9Zt+ofohX+sZioJcYYHF/d3XeLvg0:1MHsqPA/PpNf+m9HhfoxFZikcYYl9Mv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1c50b09db02d63ac7d1720efff313f0_JaffaCakes118

Files

a1c50b09db02d63ac7d1720efff313f0_JaffaCakes118
.exe windows:6 windows x64 arch:x64

fd18ac8e2778f5421cda3fcb645f580f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Nonameboi\Documents\sentient.sh\Projects\GUI Loader\x64\Release\.loader.pdb

Imports

kernel32

LoadResource
GetFileSize
Process32First
CreateFileW
CreateToolhelp32Snapshot
MultiByteToWideChar
Process32Next
GetWindowsDirectoryW
WideCharToMultiByte
DeleteFileW
GetCurrentDirectoryA
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
DecodePointer
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
FindResourceExW
LockResource
GetModuleHandleA
WriteFile
SizeofResource
ReadFile
GlobalUnlock
GetTickCount
GlobalLock
GetWindowsDirectoryA
DeleteFileA
GetCommandLineA
FindClose
CreateEventW
WaitForSingleObjectEx
ResetEvent
FindNextFileA
VirtualFree
FindFirstFileA
CreateThread
GetSystemDirectoryA
Sleep
TerminateProcess
VirtualAlloc
GetCurrentProcess
SetEvent
HeapSize
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapAlloc
WriteConsoleW
GetProcessHeap
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
RaiseException
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
FindFirstFileExW
GetLogicalDriveStringsA
CloseHandle
CreateFileA
GetLastError
GetVolumeInformationA
DeviceIoControl
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetModuleHandleExW
GetCurrentDirectoryW

user32

GetWindowThreadProcessId
EndPaint
BeginPaint
GetCursorPos
PostQuitMessage
SetCursor
LoadCursorW
MessageBoxA
TranslateMessage
CreateWindowExA
DefWindowProcA
RegisterClassA
PeekMessageW
CloseClipboard
DispatchMessageW
OpenClipboard
wsprintfW
RedrawWindow
FindWindowA
GetClipboardData
GetSystemMetrics
GetWindowLongW
CreateIconFromResourceEx
MessageBoxW
MoveWindow
LoadBitmapW
DrawIconEx
SetCursorPos
GetMessagePos
GetWindowRect
ScreenToClient

gdi32

SetBkMode

advapi32

OpenServiceA
QueryServiceStatusEx
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
OpenSCManagerA
RegOpenKeyExW
RegDeleteTreeW
RegDeleteKeyW
CloseServiceHandle
RegEnumKeyA
RegCloseKey
RegGetValueA

shell32

SHGetFolderPathA
ShellExecuteA

gdiplus

GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipDrawLineI
GdipPrivateAddFontFile
GdipDeletePrivateFontCollection
GdipCloneFontFamily
GdipNewPrivateFontCollection
GdipTranslateWorldTransform
GdipGetImageWidth
GdipCreateBitmapFromHICON
GdipCreatePen2
GdipFillRectangleI
GdipMeasureString
GdipCloneBrush
GdipRotateWorldTransform
GdipGetFontCollectionFamilyList
GdipResetWorldTransform
GdipDrawString
GdipFree
GdipCreateSolidFill
GdipCreateFont
GdipDisposeImage
GdipAlloc
GdipDeleteBrush
GdipGetImageHeight
GdipCloneImage
GdipDeleteGraphics

winhttp

WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse

ws2_32

closesocket
freeaddrinfo
connect
socket
inet_addr
WSAStartup
getaddrinfo
WSACleanup
recv
send
select

iphlpapi

GetIfEntry2
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
GetIfTable2

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAllocateHeap
NtQuerySystemInformation
NtWriteFile
RtlFreeUnicodeString
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
LdrFindResource_U
NtClose
RtlFreeHeap
NtCreateFile
LdrAccessResource
NtFreeVirtualMemory
LdrGetProcedureAddress
LdrLoadDll
NtAllocateVirtualMemory
RtlImageNtHeader
RtlInitString
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind

Sections

.text
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd18ac8e2778f5421cda3fcb645f580f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

gdiplus

winhttp

ws2_32

iphlpapi

ntdll

Sections

.text Size: 255KB - Virtual size: 255KB

.rdata Size: 101KB - Virtual size: 101KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 12KB - Virtual size: 11KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 255KB - Virtual size: 255KB

.rdata
Size: 101KB - Virtual size: 101KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 3KB - Virtual size: 3KB