2c5211d5cac8c6599153ac0c9b2f2247_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2c5211d5cac8c6599153ac0c9b2f2247_JaffaCakes118
Size

164KB
MD5

2c5211d5cac8c6599153ac0c9b2f2247
SHA1

7ebae4cfa4bfe7ab43d73423891e2577c5759722
SHA256

7c4a51330f01efd248f0b90a6174aac6f3eedf5b31a4241111686b7438754207
SHA512

c6de57e66649792b8fd95ae3e38c3d529d7d8d0baaebc6da6bdb5461b0acad06f6465f5f624baff631677982848b9c45c34397f53982d2c4e1d763f96d5575e7
SSDEEP

3072:gNr2l+9dJpiUe1K1JpHjK54MMyIcaWzXR9JegE/vZpLSkm9y4Ns256G:gB2w9dJp0s1JJmaMM/cfDRLE5pOV9P6y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c5211d5cac8c6599153ac0c9b2f2247_JaffaCakes118

Files

2c5211d5cac8c6599153ac0c9b2f2247_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28b01cd143ea13d5aaf1f5bee95a319f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
setsockopt
WSAConnect
WSASocketA
WSAWaitForMultipleEvents
getprotobynumber
WSACloseEvent

dbghelp

SymCleanup
StackWalk
StackWalk64
SearchTreeForFile
MapDebugInformation
MakeSureDirectoryPathExists
ImageRvaToVa
ImageRvaToSection
ImageNtHeader
ImageDirectoryEntryToDataEx
GetTimestampForLoadedLibrary
FindFileInSearchPath
FindFileInPath
FindDebugInfoFile
SymGetLineNext
SymGetLineNext64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromAddr
SymEnumSourceFiles
SymGetLineFromAddr64
SymFunctionTableAccess
SymEnumerateSymbols64
SymEnumerateModules
SymEnumerateModules64
SymEnumTypes
SymEnumSymbols
UnmapDebugInformation
SymUnloadModule
SymUnloadModule64
SymUnDName
SymUnDName64
SymSetSearchPath
SymSetOptions
SymMatchString
SymMatchFileName
SymLoadModule
SymGetSymNext
SymGetSymNext64
SymGetSymFromName
SymEnumSym
SymGetSearchPath
SymGetOptions
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetModuleInfo
SymGetLinePrev
SymGetLinePrev64

hlink

ord3
ord6
ord11
ord12
ord16
ord20
ord23
ord24
ord30
ord29
ord8
ord22

iphlpapi

IcmpCloseHandle
IcmpSendEcho2
IcmpSendEcho
IcmpCreateFile

imagehlp

BindImage
ImageEnumerateCertificates
ImageGetCertificateData
ImageGetCertificateHeader
ImageGetDigestStream
ImageRemoveCertificate
ImageUnload
MapAndLoad
MapFileAndCheckSumA
ReBaseImage
SetImageConfigInformation
SplitSymbols
UpdateDebugInfoFileEx
ImageLoad

msvcrt

fread
fclose
memmove
fputs
fwrite
fseek
fopen
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
atoi

kernel32

GetTempPathA
ResetEvent
PulseEvent
WaitForSingleObject
CreateEventA
GetModuleHandleA
GetStartupInfoA
WriteConsoleW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 734KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

28b01cd143ea13d5aaf1f5bee95a319f

Headers

File Characteristics

Imports

ws2_32

dbghelp

hlink

iphlpapi

imagehlp

msvcrt

kernel32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 84KB - Virtual size: 81KB

.data Size: 48KB - Virtual size: 734KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 84KB - Virtual size: 81KB

.data
Size: 48KB - Virtual size: 734KB