5d799fc730742403c65448bda5573fd4_JaffaCakes118

General

Target

5d799fc730742403c65448bda5573fd4_JaffaCakes118
Size

188KB
MD5

5d799fc730742403c65448bda5573fd4
SHA1

79e7756c21792ce3d95055d5c1238575e7170a30
SHA256

e8fcafbeb6de762d30691a362624efdb836384fd90b8a6385fdffe384d7b6786
SHA512

7d71d3f3b3584826cb82f9d5e9c9c4fe835632fe546885fa41870b2ae32176456b4f52e0903e29946ad29bcc27dde0fe61fcf87097f6ad491fc4f7d24b2f809d
SSDEEP

3072:mtyM6WabkWjclOjmBYcx2eyI4IL8H62wjdgH55beBxT6Fp6OFEwVVJ:mtyMdabkB0mak3y1RjWBxTop6U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d799fc730742403c65448bda5573fd4_JaffaCakes118

Files

5d799fc730742403c65448bda5573fd4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e0092ccefb289243d6fb89de64438b07

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
StartServiceA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
ChangeServiceConfig2A
CloseServiceHandle
DeleteService
RegRestoreKeyA
RegSaveKeyA
CreateServiceA
ControlService
GetServiceDisplayNameA
GetServiceKeyNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_ftol
strncpy
__CxxFrameHandler
srand
??2@YAPAXI@Z
memcpy
rand
strlen
memset
strcpy
_except_handler3
strcat
_strrev
_stricmp
_strlwr
strchr
__getmainargs

kernel32

RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetCurrentThread
GetCurrentProcessId
SetFileAttributesA
DeleteFileA
lstrlenA
CreateDirectoryA
GetCurrentProcess
GetCommandLineA
SetUnhandledExceptionFilter
ExpandEnvironmentStringsA
GetShortPathNameA
GetFileAttributesA
CreateEventA
WaitForSingleObject
GetModuleFileNameA
LoadLibraryA
SleepEx
GetSystemDirectoryA
CreateFileA
GetTickCount
WriteFile
GetFileTime
Sleep
GetProcAddress
GetModuleHandleA
GetLastError
ExitProcess
GetCurrentDirectoryA
GetTempPathA
MoveFileA
CloseHandle
SetFileTime

ws2_32

listen

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0092ccefb289243d6fb89de64438b07

Headers

File Characteristics

Imports

advapi32

msvcrt

kernel32

ws2_32

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 164KB - Virtual size: 164KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 164KB - Virtual size: 164KB

.rsrc
Size: 4KB - Virtual size: 3KB