0b1661f644ebe8ed95d4300daf9f52d2_JaffaCakes118

General

Target

0b1661f644ebe8ed95d4300daf9f52d2_JaffaCakes118
Size

68KB
MD5

0b1661f644ebe8ed95d4300daf9f52d2
SHA1

24d7a9f0ebe78fc22017306ed0739f93da57fc04
SHA256

482c81d7aa5118ccebeebed2256aa67a2187a43fbf676674cd577725690e4eed
SHA512

0c007fea0c43af319f3f6b85aabae18ca21deabee46b1d28e928b9a04df0019d855ae44bc68a6e289a360f141cdf9bc19be4f1eb77cf2116c5c4c627fadf542c
SSDEEP

1536:u5Y5eUUY2x+8sS2OUyGoEiO7EoZc34TYOMpkcxmDEKkObg7AIz8Qnh9u8nXPbLnV:IY5ek2xorqXgLgUDEv7fz8BkUy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b1661f644ebe8ed95d4300daf9f52d2_JaffaCakes118

Files

0b1661f644ebe8ed95d4300daf9f52d2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b79969ae598e262d12701e2a46d65fde

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

y:\projects\work\proxy-service\build\2\slave-vcproj\Release\ieassistant.pdb

Imports

ws2_32

htons
connect
getaddrinfo
shutdown
setsockopt
closesocket
send
ntohs
getsockname
recv
bind
socket
freeaddrinfo
listen
accept
getpeername
inet_ntoa
ntohl
htonl
WSAStartup

msvcrt

memset
memcpy
__getmainargs
_cexit
_exit
_XcptFilter
exit
_ismbblead
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
atoi
strncmp
_strdup
getenv
srand
rand
printf
sprintf
malloc
free
_acmdln

kernel32

GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetTickCount
WaitForSingleObject
Sleep
ExitThread
ReleaseSemaphore
CreateSemaphoreW
CloseHandle
CreateThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
RtlUnwind

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b79969ae598e262d12701e2a46d65fde

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

msvcrt

kernel32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 4KB - Virtual size: 3KB