392ea207ae1e50bb2eb0b567208cd2f3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

392ea207ae1e50bb2eb0b567208cd2f3_JaffaCakes118
Size

72KB
MD5

392ea207ae1e50bb2eb0b567208cd2f3
SHA1

1cded6b79916bf0d21172e71f847c0ba01dc11e5
SHA256

b6c7cf8c0c3523a6bf65b25c827f670938c0066e344c47519b06f1609c72de0c
SHA512

2281c29bab39f57df995718be9d43214f6324a84fcab897072999e2a0e51642eabfdbe6ecd3bfc593d3b48ef8af734f4b89fe06bc887a821bb2ef95adce1aa13
SSDEEP

1536:KjoVAe79B+i07EhtH32X3+0Xd0+hBhcwlr:JVXT+i0C32X3HXFrawlr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
392ea207ae1e50bb2eb0b567208cd2f3_JaffaCakes118

Files

392ea207ae1e50bb2eb0b567208cd2f3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

824c83a10f839164ee2861a349f9e1b1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\My Documents\Visual Studio Projects\NetMonitor\Monitor\Release\Monitor.pdb

Imports

ws2_32

socket
htons
inet_addr
connect
closesocket
send
recv
gethostname
gethostbyname
WSACleanup
WSAStartup

kernel32

GetSystemInfo
VirtualProtect
IsBadCodePtr
IsBadReadPtr
LCMapStringW
CloseHandle
SetFileTime
SystemTimeToFileTime
CreateFileA
_lclose
_lwrite
_lcreat
GetTempPathA
SetFileAttributesA
CopyFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetLocalTime
DeleteFileA
_llseek
SetFilePointer
GetLastError
CreateMutexA
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
_lread
Sleep
MultiByteToWideChar
LCMapStringA
VirtualQuery
InterlockedExchange
LoadLibraryA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoA
GetStringTypeA
_lopen
FlushFileBuffers
GetEnvironmentStringsW
GetStringTypeW
HeapSize
WideCharToMultiByte
SetStdHandle
ReadFile
ExitProcess
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
HeapAlloc
SetUnhandledExceptionFilter
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
KillTimer
SetTimer
DestroyWindow
PostQuitMessage

gdi32

GetStockObject

advapi32

RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

ole32

CoInitialize
CoTaskMemFree
CoUninitialize
CoCreateInstance

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

824c83a10f839164ee2861a349f9e1b1

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 13KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 13KB