319bd28ba639ac6e5e2050b5301ad2c0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

319bd28ba639ac6e5e2050b5301ad2c0_JaffaCakes118
Size

32KB
MD5

319bd28ba639ac6e5e2050b5301ad2c0
SHA1

3645c38365a0b42360f6f6f5a80d3558967b0b4e
SHA256

f7aa77ebdcd8dd49bd41fbcb93a400e17e5692c698706844c2af01ce44569be1
SHA512

678112735a660877b65307cbab3ec58a96bca36701b1d799014045e235e55c338dea6b1b59e7e90d5e951d9c1d2390802d884765064336a86ed221194e89baaa
SSDEEP

768:uPF0Ck80nL+FOO5kvFPqTSzDa4HX5MLonsAg+W:A0naFVIZqQTHX5yOg+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
319bd28ba639ac6e5e2050b5301ad2c0_JaffaCakes118

Files

319bd28ba639ac6e5e2050b5301ad2c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a99e55b6960d44bf1b306592413304ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
CloseServiceHandle
ControlService
StartServiceA
OpenServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA

user32

GetWindowThreadProcessId
SendMessageA
FindWindowExA
KillTimer
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
SetTimer
FindWindowA

msvcp60

??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

gdi32

GetStockObject

ws2_32

connect
ioctlsocket
socket
closesocket

msvcrt

srand
strncmp
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
atoi
_except_handler3
_controlfp
strstr
strcmp
??2@YAPAXI@Z
strcpy
_snprintf
strlen
strncpy
malloc
memset
memcpy
free
sprintf
strcat
strtok
rand
__set_app_type
strchr
_vsnprintf

kernel32

OpenProcess
VirtualAllocEx
GetStartupInfoA
ReadProcessMemory
VirtualFreeEx
GetLogicalDriveStringsA
GetDriveTypeA
lstrcatA
CreateDirectoryA
CreateMutexA
ReleaseMutex
GetTempPathA
GetLocaleInfoA
GetVersionExA
GetModuleFileNameA
ExpandEnvironmentStringsA
lstrlenA
WriteProcessMemory
SetFileAttributesA
CopyFileA
GetFileAttributesA
TerminateThread
lstrcmpiA
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
ExitThread
GetTickCount
WriteFile
CloseHandle
GetLastError
CreateThread
CreateProcessA
WaitForSingleObject
Sleep
ExitProcess

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a99e55b6960d44bf1b306592413304ea

Headers

File Characteristics

Imports

advapi32

user32

msvcp60

gdi32

ws2_32

msvcrt

kernel32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 275KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 275KB