365ab6f3b2cb58007892415625eb7125_JaffaCakes118

General

Target

365ab6f3b2cb58007892415625eb7125_JaffaCakes118
Size

24KB
MD5

365ab6f3b2cb58007892415625eb7125
SHA1

0332fe4646e5d4802f3a58728ef8c2a6f7e1549e
SHA256

a8bb8c2e4f0b75d4737ff863b9a0385083c12920f0fe478cb01eac3d9743ff06
SHA512

21cf2e9bec558d3fd72b38fa98f71711682f1bb8283101135bb425b8631032789638080e56f0294b4e225015f7a245a2b8e49764b8a28544935f2a7f299b9c49
SSDEEP

192:CpAmdCVxYX6KUU5/RKu/TK8z5l2Pd2ZR5gKUop4cVSEyb0q1NoynQ0l/GvKDR:5qHRUUdRKCTaF2ZR5xKcV+0qrV/GvKD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
365ab6f3b2cb58007892415625eb7125_JaffaCakes118

Files

365ab6f3b2cb58007892415625eb7125_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1f1a623fca0adb0606cf84efa3c412ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

php4ts

tsrm_startup
sapi_startup
ts_resource_ex
compiler_globals_id
_efree
php_header_write
php_handle_aborted_connection
php_module_startup
php_module_shutdown_wrapper
executor_globals_id
core_globals_id
sapi_globals_id
zend_llist_init
php_output_startup
php_end_ob_buffers
_estrdup
zend_llist_add_element
zend_load_extension
php_request_startup
php_module_shutdown
php_print_info
get_zend_version
php_printf
module_registry
zend_hash_apply_with_argument
zend_extensions
zend_llist_apply_with_argument
zend_llist_apply
zend_llist_destroy
zend_eval_string
php_fopen_primary_script
virtual_fopen
php_body_write
php_request_shutdown
php_lint_script
open_file_for_scanning
php_get_highlight_struct
zend_highlight
php_execute_script
_persist_alloc
empty_string
tsrm_shutdown
php_header
php_import_environment_variables
_emalloc
php_register_variable
php_handle_auth_data
zend_error
zend_alter_ini_entry

kernel32

CreateFileA
CloseHandle
GetFileSize
SetFilePointer
ReadFile
GetModuleFileNameA

msvcrt

_strdup
_read
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
strchr
atoi
_setjmp3
_fmode
printf
exit
malloc
fopen
fputs
fclose
strrchr
strtok
fgetc
rewind
free
fprintf
sprintf
getenv
fflush
_iob
_setmode
_unlink
fwrite

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f1a623fca0adb0606cf84efa3c412ea

Headers

File Characteristics

Imports

php4ts

kernel32

msvcrt

Sections

.text Size: 8KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 8KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB