6508ee27afe517aa846f9447faef59b8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6508ee27afe517aa846f9447faef59b8_JaffaCakes118
Size

64KB
MD5

6508ee27afe517aa846f9447faef59b8
SHA1

05b72be669daf775ad677f27af8adbb914453cf2
SHA256

049dd4016eeaa16e0a4a88cd8b789a1260cb5e42f784d4e11a4b8e65366d3f21
SHA512

a51774105c14374835491786efb76c301dafc56ae64d7810caf0e2193f75725a1bb01a01f7987281a8919dfcb80221c4b9af7ab7bd94678ae81640d4f953060a
SSDEEP

1536:wqWpISBkDd4EUIfHdC3Ft+yyG+o3eA0jtz:uIdDd4EH6r+y3+oSz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6508ee27afe517aa846f9447faef59b8_JaffaCakes118

Files

6508ee27afe517aa846f9447faef59b8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5b3add3d9b972550ff1dbc56f771641f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA

kernel32

CreateThread
CreateEventA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetWindowsDirectoryA
CopyFileA
DeleteFileA
SetFileAttributesA
CreateMutexA
Sleep
WaitForSingleObject
SetEvent
ExitProcess
lstrcmpiA
CloseHandle
OpenMutexA
GetComputerNameA
GetSystemDefaultLangID
GetVersionExA
GetFileSize
GetVolumeInformationA
GetDriveTypeA
GetLogicalDriveStringsA
FindClose
FindNextFileA
GetFileAttributesA
SetFileTime
GetFileTime
CreateProcessA
SetCurrentDirectoryA
WriteFile
CreateFileA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetEnvironmentVariableA
SetStdHandle
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetLastError
MoveFileA
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ReadFile
TerminateProcess
GetCurrentProcess
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr

wsock32

gethostname
gethostbyname
WSAGetLastError
ioctlsocket
socket
inet_ntoa
htons
connect
select
closesocket
recv
WSAStartup
WSACleanup
inet_addr

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b3add3d9b972550ff1dbc56f771641f

Headers

File Characteristics

Imports

advapi32

kernel32

wsock32

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 8KB - Virtual size: 4KB