4456a4cedd3cdf3c94405a015954959c_JaffaCakes118

General

Target

4456a4cedd3cdf3c94405a015954959c_JaffaCakes118
Size

48KB
MD5

4456a4cedd3cdf3c94405a015954959c
SHA1

5d9bc4df8075071f04da04d57ad34d963f8768d0
SHA256

79abd954c67edf1d8a6c23b91bdc7b9c05cdf2c52d5f0efc0c347555faffa6a9
SHA512

78fa3b6ab8e8389cfde2ad234acd00bbd9783d6e79d1ee1e6758fe911c0e961e118b3f5480cfe1a6065e271bfa1d44bf8ac6a367880fa96ee0f088916ace3941
SSDEEP

768:mRPyXHuttc8Yrsh8LhrLZugIvmSHrHglg5:m8HAtc8YDLhrLivmSHcl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4456a4cedd3cdf3c94405a015954959c_JaffaCakes118

Files

4456a4cedd3cdf3c94405a015954959c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

feaa59a4c8b2c30ab928459480196043

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

recv
send
closesocket
connect
htons
getservbyname
socket
gethostbyaddr
gethostbyname
ioctlsocket
WSACleanup
WSAStartup

kernel32

GetEnvironmentStringsW
SetEndOfFile
HeapSize
LCMapStringW
LCMapStringA
GetLocaleInfoA
InterlockedExchange
RtlUnwind
LoadLibraryA
GetStringTypeW
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
Sleep
GetVolumeInformationA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
GetLastError
WriteFile
HeapFree
CloseHandle
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
ReadFile
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
HeapAlloc
CompareStringA
MultiByteToWideChar
GetCPInfo
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
CreateFileA
FlushFileBuffers
VirtualAlloc
HeapReAlloc
SetStdHandle
QueryPerformanceCounter

shell32

ShellExecuteA

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

feaa59a4c8b2c30ab928459480196043

Headers

File Characteristics

Imports

wsock32

kernel32

shell32

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 8KB

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 8KB