3964ec2fe493ed566a404e9dd33434a5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3964ec2fe493ed566a404e9dd33434a5_JaffaCakes118
Size

352KB
MD5

3964ec2fe493ed566a404e9dd33434a5
SHA1

bca121cbdfb1c1212c27de720bcaa5c3a6fa845c
SHA256

3b98e6c87edfb4da99612025cf485d302d42c184e73bcb727f9807923bfa9850
SHA512

a39f9318f6307693e14958d8b985b6f78d5113e53a85bf55be7d6cf8aadd8921034d16b624898dac08ef2e17e8d56d1d7ef2d90853dd62ff12d0aa5a0c002340
SSDEEP

6144:+87Sm49lFRQSAe5klIQm3n/ym1grjpY7nf9av3lYdkv+hgG2SnG4j/gU:Wm+3QSAdm3n/yogZg0v3Gqv0gG2mG4rv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3964ec2fe493ed566a404e9dd33434a5_JaffaCakes118

Files

3964ec2fe493ed566a404e9dd33434a5_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Pieceespecially\watchPeriod\farmShine\Sing.pdb

Imports

kernel32

ExitProcess
GetFileAttributesA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
MultiByteToWideChar
GetShortPathNameA
CopyFileA
GetTempFileNameA
LoadLibraryA
WaitForMultipleObjects
GetModuleFileNameA
VirtualProtect
GetCurrentProcessId
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetCPInfo
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
HeapSize
GetUserDefaultLCID
SetEnvironmentVariableA

ws2_32

ioctlsocket
inet_ntoa
WSAStartup
recvfrom
ntohl
inet_addr
htons
WSACleanup
recv
socket
getservbyname
send
getsockopt
listen

Exports

Exports

DllRegisterServer
Exactnature
Happenthousand
Probablepath

Sections

.text
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 241KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 16KB - Virtual size: 385KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 244KB - Virtual size: 241KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 16KB - Virtual size: 385KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB