48ac334e786156ef605b82dd563373f4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

48ac334e786156ef605b82dd563373f4_JaffaCakes118
Size

352KB
MD5

48ac334e786156ef605b82dd563373f4
SHA1

1710cf3539eaaf618a613e690157adf30550fade
SHA256

71b928fd0b29e21bbfa4755b5347f4dc40653a82ec7ecf4947e325dbec23abaa
SHA512

e32f9f05ede3025e108f307f6c76bd95b00dadb64e5cc45e78793e8bf97c929ba26802f7bff8d27b570459df695f4e3e67cd2e6b7563055cdc895530d7ce557c
SSDEEP

6144:+87Sm49lFRQSAe5klIQm3n/ym1grjpY7nf9fv3lYdkv+hgG2KnG4r/gU:Wm+3QSAdm3n/yogZgJv3Gqv0gG2uG4jv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48ac334e786156ef605b82dd563373f4_JaffaCakes118

Files

48ac334e786156ef605b82dd563373f4_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Pieceespecially\watchPeriod\farmShine\Sing.pdb

Imports

kernel32

ExitProcess
GetFileAttributesA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
MultiByteToWideChar
GetShortPathNameA
CopyFileA
GetTempFileNameA
LoadLibraryA
WaitForMultipleObjects
GetModuleFileNameA
VirtualProtect
GetCurrentProcessId
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetCPInfo
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
HeapSize
GetUserDefaultLCID
SetEnvironmentVariableA

ws2_32

ioctlsocket
inet_ntoa
WSAStartup
recvfrom
ntohl
inet_addr
htons
WSACleanup
recv
socket
getservbyname
send
getsockopt
listen

Exports

Exports

DllRegisterServer
Exactnature
Happenthousand
Probablepath

Sections

.text
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 241KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 16KB - Virtual size: 385KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 244KB - Virtual size: 241KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 16KB - Virtual size: 385KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB