4b5baee16b98cf6ea78a5be7505ecd36_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b5baee16b98cf6ea78a5be7505ecd36_JaffaCakes118
Size

64KB
MD5

4b5baee16b98cf6ea78a5be7505ecd36
SHA1

ccc1f6ae40e46205ee95baae9e5e379849a6bb01
SHA256

a5030ac4917a1cd657fea0e1525570bc2e1f279d8aa3b73d42c29e38a6e35b6d
SHA512

4d0df75a973b115a47403cd9ec4ac78e1c23d644af761688d4b8183ef100b7cbd7549c5ecb97520014874b6f01b47688974909faf82aafb048258e674ecfddb6
SSDEEP

1536:08rxTSbz8fLAukSrQeHNa4g9dibBpRXfJftVi4rsMaO:nZIzgsubrrHOdibBptfJftUz6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b5baee16b98cf6ea78a5be7505ecd36_JaffaCakes118

Files

4b5baee16b98cf6ea78a5be7505ecd36_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e62d4c29296cc4214ceec54fd3c7673d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

shutdown
inet_ntoa
ioctlsocket
ntohl
htonl
getsockname
gethostbyname
WSAStartup
select
inet_addr
connect
send
recv
closesocket
htons
socket
setsockopt
bind
listen
accept
WSACleanup

shell32

SHGetFolderPathA

advapi32

RegQueryValueExA
RegDeleteValueA
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA

wininet

InternetReadFile
InternetOpenA
InternetOpenUrlA

kernel32

GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
ReadFile
HeapReAlloc
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
SetErrorMode
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
CloseHandle
GetCurrentProcess
FindClose
FindFirstFileA
DeleteFileA
SetFileAttributesA
TerminateProcess
OpenProcess
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
ExitProcess
CreateProcessA
ExitThread
CreateThread
GetModuleFileNameA
WaitForSingleObject
CreateMutexA
SetEndOfFile
GetTickCount
GetTempPathA
GetLastError
CreateDirectoryA
GetVersionExA
TerminateThread
ExpandEnvironmentStringsA
GetFileAttributesA
GetModuleHandleA
WriteFile
CreateFileA
CopyFileA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
SetFileTime
GetFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetVersion
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc

user32

CharLowerA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

MSDEV
Size: 60B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e62d4c29296cc4214ceec54fd3c7673d

Headers

File Characteristics

Imports

ws2_32

shell32

advapi32

wininet

kernel32

user32

version

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 14KB - Virtual size: 26KB

MSDEV Size: 60B - Virtual size: 4KB

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 14KB - Virtual size: 26KB

MSDEV
Size: 60B - Virtual size: 4KB