062d0ca5124d2f6bf590ba00edfabdc3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

062d0ca5124d2f6bf590ba00edfabdc3_JaffaCakes118
Size

72KB
MD5

062d0ca5124d2f6bf590ba00edfabdc3
SHA1

ba54895ec1eff510bf1ff49e486897ff668a4142
SHA256

c34c53e7d32191b820e23cf4bc420c629e5fdb2dec4ea6695408e084e0e95119
SHA512

55eee7ae673a5bad6b1b499f3ccffea2c7a75f84a3a091b231ea516b543e5a95adac4e0813bdf1e3246f3ca47fe29a7cbb96e787c5e77c7c94124bf9ec25b18e
SSDEEP

1536:OXtNuF95tpt6EmWatdNWIptjcAwmVVxkA0YocP6u6fOXOXhEN5dhx0n47:wr5t+fOXOXON5dhx0nw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
062d0ca5124d2f6bf590ba00edfabdc3_JaffaCakes118

Files

062d0ca5124d2f6bf590ba00edfabdc3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2f95a68e9c193c98fd61959cde46fe00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetShortPathNameA
GetLastError
GetProcAddress
CopyFileA
SetFileAttributesA
LoadLibraryA
OpenMutexA
GetModuleFileNameA
CreateMutexA
ExitThread
WinExec
CloseHandle
GetTempPathA
ResumeThread
CreateThread
lstrcpyA
GetLocaleInfoW
GlobalMemoryStatusEx
GetEnvironmentVariableA
lstrcatA
GetSystemDirectoryA
TerminateProcess
CreateProcessA
Sleep
GetCurrentThread
GetTickCount
WaitForSingleObject
GetCurrentProcess
lstrlenA
SetPriorityClass
CreateFileA
ReleaseMutex
ExitProcess
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
HeapSize
HeapAlloc
GetModuleHandleW
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind

user32

GetDesktopWindow
wsprintfA

advapi32

RegCloseKey
RegOpenKeyA
OpenSCManagerA
SetServiceStatus
RegOpenKeyExA
StartServiceA
CreateServiceA
RegisterServiceCtrlHandlerA
RegSetValueExA
DeleteService
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenServiceA
RegQueryValueExA

shell32

ShellExecuteA

ws2_32

htons
setsockopt
sendto
recv
select
__WSAFDIsSet
closesocket
gethostbyname
send
WSASocketA
htonl
inet_addr
WSAStartup
socket
connect

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f95a68e9c193c98fd61959cde46fe00

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB