282b902a356c196b4a097431a9aa576e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

282b902a356c196b4a097431a9aa576e_JaffaCakes118
Size

352KB
MD5

282b902a356c196b4a097431a9aa576e
SHA1

2bf3698a4f386c2f30b810964f1045ccc6929bdd
SHA256

d33a4d3ac76095145e6061009fc20432b5c2c6ec4a828c7b6956ea5f072f2c34
SHA512

299d44e17940c3685e6e650e3f4cb6e0eb99a4be574a96b83fae71df363e5a03b6348d6906b46021b7ae05e53c48afae5c9f37b2dba5b365f5ff7f077afd4197
SSDEEP

6144:g87Sm49lFRQSAe5klIQm3n/ym1grjpY7nf9Gv3lYdkv+hgG2snG4Z/gU:Im+3QSAdm3n/yogZgsv3Gqv0gG20G45v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
282b902a356c196b4a097431a9aa576e_JaffaCakes118

Files

282b902a356c196b4a097431a9aa576e_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Pieceespecially\watchPeriod\farmShine\Sing.pdb

Imports

kernel32

ExitProcess
GetFileAttributesA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
MultiByteToWideChar
GetShortPathNameA
CopyFileA
GetTempFileNameA
LoadLibraryA
WaitForMultipleObjects
GetModuleFileNameA
VirtualProtect
GetCurrentProcessId
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetCPInfo
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
HeapSize
GetUserDefaultLCID
SetEnvironmentVariableA

ws2_32

ioctlsocket
inet_ntoa
WSAStartup
recvfrom
ntohl
inet_addr
htons
WSACleanup
recv
socket
getservbyname
send
getsockopt
listen

Exports

Exports

DllRegisterServer
Exactnature
Happenthousand
Probablepath

Sections

.text
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 241KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 16KB - Virtual size: 385KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 244KB - Virtual size: 241KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 16KB - Virtual size: 385KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB