5cb7319271e8a38f067102d773ae1930_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5cb7319271e8a38f067102d773ae1930_JaffaCakes118
Size

103KB
MD5

5cb7319271e8a38f067102d773ae1930
SHA1

4ee8111f3ee501cef5ce04223ca20943371588da
SHA256

d220a8eeb0564c4f60b09d985c0bee385a8113fbdaf160a4e78d6cada1b838f1
SHA512

1a6daab019d389ee4ed2cf3aabd262a7bf3b7f0de2fa42238fe049d5f5e3e0e9ce4ceead1b44432655229d3aa4392eb123285bbb8122a11a2fd69a57e7bba021
SSDEEP

3072:xh6wYEHgsyp6OzBgUEe/Xl5/ly/ICKPzSL5Qjy:H9YviUV+/BIzjy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cb7319271e8a38f067102d773ae1930_JaffaCakes118

Files

5cb7319271e8a38f067102d773ae1930_JaffaCakes118
.exe windows:5 windows x86 arch:x86

024c4c5d4c8b6b2da9fcf552f3ff23f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

shutdown
inet_ntoa
ioctlsocket
ntohl
htonl
getsockname
gethostbyname
WSAStartup
select
setsockopt
bind
listen
accept
recv
send
inet_addr
htons
socket
connect
closesocket
WSACleanup

shell32

SHGetFolderPathA

wininet

InternetReadFile
InternetOpenA
InternetOpenUrlA

user32

CharLowerA

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
CloseHandle
GetCurrentProcess
FindClose
FindFirstFileA
Process32Next
DeleteFileA
SetFileAttributesA
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetWindowsDirectoryA
GetLocaleInfoA
Sleep
ExitProcess
CreateProcessA
ExitThread
GetModuleFileNameA
CreateThread
GetTickCount
GetTempPathA
WaitForSingleObject
CreateMutexA
SetErrorMode
GetLastError
CreateDirectoryA
TerminateThread
GetVersionExA
ExpandEnvironmentStringsA
GetFileAttributesA
GetModuleHandleA
WriteFile
CreateFileA
CopyFileA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
SetFileTime
GetFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapSize
SetEndOfFile
GetProcessHeap
GetSystemDirectoryA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
HeapAlloc
HeapFree
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetStdHandle
RtlUnwind
ReadFile
SetHandleCount
GetFileType
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
GetUserNameA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

024c4c5d4c8b6b2da9fcf552f3ff23f1

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shell32

wininet

user32

kernel32

advapi32

version

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 9KB - Virtual size: 22KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 9KB - Virtual size: 22KB

.rsrc
Size: 512B - Virtual size: 436B