0fca511cd2c4086370a1bdcb5f801d4d_JaffaCakes118

General

Target

0fca511cd2c4086370a1bdcb5f801d4d_JaffaCakes118
Size

370KB
MD5

0fca511cd2c4086370a1bdcb5f801d4d
SHA1

7f0911259cdd4d4af627d716fe7ca02140e840cd
SHA256

d46f669678968f212056579f839b6b65f56924266b6c19278833410d161553b9
SHA512

e30fb05d5e5b4a3b932ec7984945402d2ba6322fc430196da040ad6e3641eee00f13dc9c81f73f40acf6e5b4bd66a955686b190029794a7d2cbe83c99498f661
SSDEEP

6144:VEgtFyGpqVrgl+sCOmBf/gHYyAggSaxArqpuy2qUhjdjiByQQ0RcfD/PFjGCsUWR:OkXsV6CNBf/gZoxAZy2OByQBRa/NbWFH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fca511cd2c4086370a1bdcb5f801d4d_JaffaCakes118

Files

0fca511cd2c4086370a1bdcb5f801d4d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b234671226094a7c5d1950b6a3a3a55

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetServiceStatus
StartServiceA
RegisterServiceCtrlHandlerA
ControlService
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
OpenServiceA

kernel32

BindIoCompletionCallback
InterlockedIncrement
Sleep
GetCurrentProcess
InterlockedDecrement
GetLastError
SleepEx
SetLastError
LeaveCriticalSection
GetQueuedCompletionStatus
CreateEventA
EnterCriticalSection
GetConsoleOutputCP
DeviceIoControl
DeleteCriticalSection
PostQueuedCompletionStatus
lstrcpyW
GetConsoleCP
ResetEvent
GetOverlappedResult
SetEvent
Beep
InitializeCriticalSection

rtutils

TracePrintfA
TraceDumpExA
TracePutsExA
TraceRegisterExA
TraceDeregisterExA
TraceDeregisterA
TracePrintfExA

ntdll

NtImpersonateThread
RtlUnwind
RtlFreeHeap
RtlInitUnicodeString
NtDeviceIoControlFile
RtlAllocateHeap
NtCreateFile
NtAllocateVirtualMemory
wcsstr
wcsncpy
NtOpenFile
RtlQueueWorkItem
NtWaitForSingleObject

ws2_32

WSARecvFrom

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 338KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b234671226094a7c5d1950b6a3a3a55

Headers

File Characteristics

Imports

advapi32

kernel32

rtutils

ntdll

ws2_32

Sections

.text Size: 8KB - Virtual size: 7KB

.rsrc Size: 20KB - Virtual size: 19KB

.rdata Size: 338KB - Virtual size: 337KB

.data Size: 3KB - Virtual size: 1.2MB

.text
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 20KB - Virtual size: 19KB

.rdata
Size: 338KB - Virtual size: 337KB

.data
Size: 3KB - Virtual size: 1.2MB