5d12fcc39890a4839ef7598523e9c4d6_JaffaCakes118

General

Target

5d12fcc39890a4839ef7598523e9c4d6_JaffaCakes118
Size

68KB
MD5

5d12fcc39890a4839ef7598523e9c4d6
SHA1

7baf86b954c724e9217eab0b74a46bf012a3e7bd
SHA256

e9d46474628d317eb3546bb9021bc6074b51a765ea35e77d04e2865aac913aab
SHA512

9e3840c8d280175ed5eb795527818efeb293b4a3d2ae1932043e79f414a12b46cd330162586aff49d71091eb64df98616892521a8aa99976cd79db56c74cc5e5
SSDEEP

1536:Rw35MkmkyNXn6B0bkG20vbRUmDEKkObg7AIz8Qnh9u8nXPbLnnnnHUq:m35driXn6BfG20BEv7fz8BkUq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d12fcc39890a4839ef7598523e9c4d6_JaffaCakes118

Files

5d12fcc39890a4839ef7598523e9c4d6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9e1ca9bedfd1c02436e04226192914c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

y:\projects\work\proxy-service\build\2\slave-vcproj\Release\ieassistant.pdb

Imports

ws2_32

htons
connect
getaddrinfo
shutdown
setsockopt
closesocket
send
ntohs
getsockname
recv
bind
socket
freeaddrinfo
listen
accept
getpeername
inet_ntoa
ntohl
htonl
WSAStartup

msvcrt

__getmainargs
_cexit
_exit
_XcptFilter
exit
_acmdln
memcpy
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
memset
_ismbblead
atoi
strncmp
_strdup
getenv
srand
rand
printf
sprintf
malloc
free
_initterm

kernel32

GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetTickCount
WaitForSingleObject
Sleep
ExitThread
ReleaseSemaphore
CreateSemaphoreW
CloseHandle
CreateThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
RtlUnwind

gdi32

GetBkColor

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e1ca9bedfd1c02436e04226192914c0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

msvcrt

kernel32

gdi32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 4KB - Virtual size: 3KB