4322ecd51aabd2d89273c603b1a00067_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4322ecd51aabd2d89273c603b1a00067_JaffaCakes118
Size

120KB
MD5

4322ecd51aabd2d89273c603b1a00067
SHA1

95714c24c9611a4472224b0d32d1fe1f17e40884
SHA256

52aed2a214b0ac3bec89c72a6b88e9b3d3020af1a809bcb5aa8ce6b6e0dadda5
SHA512

141b0cfa683f4382ec48c6c605421c54bd0037c09db309d749a171b0b63b9d16062c1a91067d97e503e0e7cc4ea69cadb1eccfdef9f5c3b772351396e1e4bc41
SSDEEP

3072:azOqcBCR+ZTcsxIkdII4nZncmjO0bz3+jczO1:QlccR+usTOZC0bz3o1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4322ecd51aabd2d89273c603b1a00067_JaffaCakes118

Files

4322ecd51aabd2d89273c603b1a00067_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4962586a7f30fe4ef2cdfc38cb768733

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
WSAIoctl
bind
htons
socket
ntohl
ntohs
closesocket
recv
gethostname
listen
setsockopt
WSASetLastError
connect
inet_addr
WSACleanup
accept
send
gethostbyname
inet_ntoa

kernel32

SetEndOfFile
SetFilePointer
GetSystemDirectoryA
GetFileSize
CreateFileA
GetLocalTime
DeviceIoControl
LoadLibraryA
ReadFile
FreeLibrary
Sleep
CreateMutexA
LocalFree
FormatMessageA
TerminateProcess
OpenProcess
GetSystemInfo
GetWindowsDirectoryA
DeleteFileA
WriteFile
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
SetFileTime
GetFileTime
CopyFileA
GetModuleFileNameA
GetCurrentProcessId
GetModuleHandleA
WinExec
PeekNamedPipe
CreateProcessA
CreatePipe
GetVersion
GetProcAddress
GetVersionExA
GetCurrentProcess
CloseHandle
GetLastError
SetEnvironmentVariableA
HeapFree
CreateThread
CompareStringA
FlushFileBuffers
SetStdHandle
CompareStringW
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
RtlUnwind
GetTimeZoneInformation
GetSystemTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ResumeThread
IsBadWritePtr
TlsSetValue
ExitThread
ExitProcess
HeapAlloc
GetCommandLineA
GetCurrentThreadId
TlsAlloc
SetLastError
TlsGetValue
GetOEMCP
FreeEnvironmentStringsA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
WriteConsoleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc

user32

wsprintfA
ExitWindowsEx
LoadStringA

shlwapi

SHDeleteKeyA

advapi32

CreateServiceA
RegDeleteKeyA
RegCloseKey
ControlService
ChangeServiceConfigA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
StartServiceCtrlDispatcherA
EnumServicesStatusA
DeleteService
RegEnumValueA
RegEnumKeyA
RegCreateKeyA
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
GetUserNameA
CloseServiceHandle
RegOpenKeyA
RegSetValueExA
RegQueryValueExA

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4962586a7f30fe4ef2cdfc38cb768733

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

shlwapi

advapi32

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 12KB - Virtual size: 20KB

.rsrc Size: 40KB - Virtual size: 40KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 12KB - Virtual size: 20KB

.rsrc
Size: 40KB - Virtual size: 40KB