64673239a825ace38b88902d008984fb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

64673239a825ace38b88902d008984fb_JaffaCakes118
Size

82KB
MD5

64673239a825ace38b88902d008984fb
SHA1

9ba3a443de7572e18af0d64d49b959c952013e0e
SHA256

f18fa4fd58118dfdf0280e101bba6d84bce5a8da6ffd540b8deb28d05322e7f5
SHA512

734a4a6e47245354af5d9c837d08b95908ae0c64e1ba662ce2a7165ad06549c99356c6fd74197d490e9a6e8542140bfe9202ae11da52541c997ea68e61c7b172
SSDEEP

1536:CjlB9Fv7givZ3hqwxkosSNBJaw1WoR3wGrRSILaTXOI2G:Cjljl7HpTBpTR3ZcTXOI2G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64673239a825ace38b88902d008984fb_JaffaCakes118

Files

64673239a825ace38b88902d008984fb_JaffaCakes118
.exe windows:6 windows x86 arch:x86

08febb13eb9bdf0025f42deb660b39aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Builds\NovaCore\Main_Releases\1.01.01\CAPI\server\build\win\Release\NvtlSrvr.pdb

Imports

ws2_32

WSAStartup
inet_addr
shutdown
bind
socket
closesocket
listen
select
getsockname
setsockopt
__WSAFDIsSet
accept
ntohl
htonl
WSAGetLastError
htons
ntohs
recv
send

shlwapi

PathFindFileNameW

kernel32

InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
WaitForSingleObject
GetCurrentProcessId
Sleep
LeaveCriticalSection
EnterCriticalSection
GetExitCodeThread
DeleteCriticalSection
CloseHandle
FreeLibrary
LoadLibraryW
GetProcAddress
GetCurrentThreadId
OutputDebugStringA
WideCharToMultiByte
GetModuleFileNameW
GetLastError
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetSystemTimeAsFileTime
InitializeCriticalSection

advapi32

CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceConfig2W
ChangeServiceConfig2W
ChangeServiceConfigW
SetServiceStatus
RegisterServiceCtrlHandlerW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

msvcr90

?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
memset
memcpy
free
calloc
malloc
strlen
strncpy
__CxxFrameHandler3
??3@YAXPAX@Z
realloc
??2@YAPAXI@Z
sprintf
fopen
fwrite
fclose
_beginthreadex
strcpy
fflush
printf
_ftime64
strftime
_localtime64
_time64
_stricmp
_wcsicmp
_wtoi
isspace
_swprintf
atoi
wcslen
_chdir
_vsnprintf
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08febb13eb9bdf0025f42deb660b39aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

shlwapi

kernel32

advapi32

msvcr90

Sections

.text Size: 57KB - Virtual size: 56KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 56KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 3KB