2de0ec4578d1610935773cff1bb0afb3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2de0ec4578d1610935773cff1bb0afb3_JaffaCakes118
Size

52KB
MD5

2de0ec4578d1610935773cff1bb0afb3
SHA1

914b6078a9a27f524d059c7dca34f9f99245e646
SHA256

9d518f42248a3e714f809466dd396bd89b91e477e0408ac0a3b0a22029d481a1
SHA512

9bc084efbe4de0f8ab70eb9f914c0a42fc26365eb3bf61235075f87baf454a2eb65bec799bf9773c701a00cef0884ed83394a3faaa0e0e16ca9c533b3f2acfa1
SSDEEP

768:RJleOXkwfGP9kZ5jXyH8Uj/sIkING9thxNwrD:hrXkrkZ5j6zjDkg0ZgD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2de0ec4578d1610935773cff1bb0afb3_JaffaCakes118

Files

2de0ec4578d1610935773cff1bb0afb3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

317384df054a1c67c6f86592a75fd179

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\C++\_networking\Backdoors\BBack_\Release\BBack_.pdb

Imports

kernel32

GetVersionExA
GetComputerNameA
Sleep
TerminateProcess
WriteFile
ReadFile
PeekNamedPipe
CloseHandle
GetCurrentDirectoryA
GetStartupInfoA
CreatePipe
WinExec
CreateFileA
GetTempPathA
ExitProcess
HeapSize
SetFilePointer
lstrcmpiA
GetSystemDirectoryA
GetTickCount
GetCommandLineA
CreateProcessA
CopyFileA
FlushFileBuffers
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetCPInfo
GetOEMCP
GetACP
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
InterlockedExchange
RtlUnwind
LoadLibraryA
GetFileType
SetHandleCount
SetStdHandle
GetEnvironmentStringsW
GetLastError
WideCharToMultiByte
HeapFree
HeapAlloc
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

wsprintfA

advapi32

RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

wsock32

send
recv
socket
ioctlsocket
WSAGetLastError
htons
inet_ntoa
connect
select
shutdown
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname

wininet

InternetReadFile
InternetCloseHandle
InternetOpenA
InternetQueryOptionA
InternetOpenUrlA

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

317384df054a1c67c6f86592a75fd179

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

wsock32

wininet

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 928B

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 928B