2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118

General

Target

2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118
Size

300KB
MD5

2be0cec0a6009ae7e2e1c2d83ec9db04
SHA1

cee436c7cf35c4e1f136d8e4421ff16e08154247
SHA256

b08d9ea7448561e8a9ae66b789b1a8fcca7adc26e9fa3d33359ff57727bbde5e
SHA512

0f8dcd5ff964d1c6f8051c05bd4093b6059edb4654b15b8d67f0ae86daf634c86d3561b0553b7ee0f14896e7777cc3929bb64678d351f7b9cfe4ab86663d1bfc
SSDEEP

6144:ZkF4Q0aQ7Bgk36c7qXJIGkyOxJW3r01h3xRIjNY0QcKU1Wgem7yOc:SmQ0aQtr6c7mjOxJBfxRCdQcveJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118

Files

2be0cec0a6009ae7e2e1c2d83ec9db04_JaffaCakes118
.dll windows:4 windows x86 arch:x86

73bc20be16507673a195e4c43e7f1c08

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BUILD_~1\jdk6_06\control\build\WINDOW~1\tmp\sun\hprof_jvmti\obj\hprof.pdb

Imports

wsock32

ntohl
ntohs
htonl
WSAStartup
WSACleanup
send
shutdown
recv
socket
gethostbyname
htons
connect

winmm

timeGetTime

msvcr71

_open
_close
_read
_getpid
_strdup
_errno
isprint
strncpy
_iob
fprintf
vfprintf
abort
signal
exit
strrchr
remove
tolower
strchr
strtod
strtol
getenv
_write
ctime
time
_lseeki64
_vsnprintf
strerror
sprintf
qsort
malloc
_initterm
_adjust_fdiv
__CppXcptFilter
_except_handler3
__dllonexit
_onexit
free

kernel32

GetProcAddress
LoadLibraryA
Sleep
GetSystemTime
SystemTimeToFileTime
FormatMessageA
FreeLibrary
GetLastError
GetModuleFileNameA

Exports

Exports

_Agent_OnLoad@12
_Agent_OnUnload@4

Sections

.text
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73bc20be16507673a195e4c43e7f1c08

Headers

File Characteristics

PDB Paths

Imports

wsock32

winmm

msvcr71

kernel32

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 88KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 168KB - Virtual size: 165KB

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 92KB - Virtual size: 88KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 168KB - Virtual size: 165KB

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 8KB - Virtual size: 6KB