14865979b7de1bd85db6acfdc80f586d_JaffaCakes118

General

Target

14865979b7de1bd85db6acfdc80f586d_JaffaCakes118
Size

68KB
MD5

14865979b7de1bd85db6acfdc80f586d
SHA1

62b82f777b7adf1749129438a918568bb5dba199
SHA256

4053633e95b1cd13bd4148b4ab73800c9d4e31d5c32e243a383433b982db2c65
SHA512

f7ca61784980068dac771a73b525e3dd306db93a5b64045be9f071fc38d4533720e1e9fd540a1c0105c79608dcd239cf776c32986df8e510a315096b1069220d
SSDEEP

1536:MGf8Y252ssS2OEyGoEiObEIpk34bYesPPmDEKkObg7AIz8Qnh9u8nXPbLnnnnHUF:525A7qXwrQSEv7fz8BkUF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14865979b7de1bd85db6acfdc80f586d_JaffaCakes118

Files

14865979b7de1bd85db6acfdc80f586d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b79969ae598e262d12701e2a46d65fde

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

y:\projects\work\proxy-service\build\2\slave-vcproj\Release\ieassistant.pdb

Imports

ws2_32

htons
connect
getaddrinfo
shutdown
setsockopt
closesocket
send
ntohs
getsockname
recv
bind
socket
freeaddrinfo
listen
accept
getpeername
inet_ntoa
ntohl
htonl
WSAStartup

msvcrt

memset
memcpy
__getmainargs
_cexit
_exit
_XcptFilter
exit
_ismbblead
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
atoi
strncmp
_strdup
getenv
srand
rand
printf
sprintf
malloc
free
_acmdln

kernel32

GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetTickCount
WaitForSingleObject
Sleep
ExitThread
ReleaseSemaphore
CreateSemaphoreW
CloseHandle
CreateThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
RtlUnwind

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b79969ae598e262d12701e2a46d65fde

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

msvcrt

kernel32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 4KB - Virtual size: 3KB