65ac76a937e1a66aff1fed3861275375_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

65ac76a937e1a66aff1fed3861275375_JaffaCakes118
Size

5.8MB
MD5

65ac76a937e1a66aff1fed3861275375
SHA1

99f8fd0393035a0b3377f81f0defd1fa854d4277
SHA256

db95ad34c701ff3b11b96f9c3d98a004379df8ae3e2b871857b23603806788a4
SHA512

6dc031118354e24f4a00e4a0e3aa0e0450dc76c88bc44faf451e60ccd34e67a9ac6b269c465a9746cd9099de6fec98db3e86a5f1df5034fd407eddadd7e26829
SSDEEP

98304:uxCaY617mQ31IKv22KiZVfUInmtiDNsuMNfRKqENcJdHTKccIY3aawds+zI4EUsb:EY6BPIKTKIBTm8NQqrNcJJDcIYqaADUL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65ac76a937e1a66aff1fed3861275375_JaffaCakes118

Files

65ac76a937e1a66aff1fed3861275375_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ab85c1688763a35ef874d93a4260050a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACancelAsyncRequest
WSASetBlockingHook
WSAGetLastError
WSASocketW
WSAEnumProtocolsW
WSARecvFrom
WSALookupServiceEnd
WSAUnhookBlockingHook
gethostbyaddr
WSAAsyncGetHostByName

version

GetFileVersionInfoA
VerInstallFileA
VerQueryValueA

oleaut32

VariantCopy
VariantChangeType
SafeArrayGetElement
QueryPathOfRegTypeLi
LoadTypeLibEx

kernel32

GetEnvironmentStringsW
ExitProcess
LocalReAlloc
WritePrivateProfileSectionA
OutputDebugStringA
VirtualProtect
WritePrivateProfileStringW
SetEndOfFile
GlobalUnlock
EnumResourceLanguagesW
GenerateConsoleCtrlEvent
FindFirstFileA
AllocConsole
FreeResource
VirtualUnlock
IsProcessorFeaturePresent
SetConsoleActiveScreenBuffer
CreateNamedPipeW
GetBinaryTypeW
FormatMessageA
GetThreadPriority
IsBadWritePtr
EnumResourceNamesA

user32

GrayStringW
BroadcastSystemMessageW
IsRectEmpty
ScreenToClient
ShowWindow
SwitchDesktop
ChangeDisplaySettingsW
InternalGetWindowText
ClientToScreen
GetClipboardSequenceNumber
SendMessageW
AdjustWindowRect
DrawTextW
ToAscii
CharLowerW
DeleteMenu
GetMenuItemInfoW
GetWindowRgn

advapi32

GetSecurityDescriptorGroup
RegOpenKeyExA
RegQueryValueW
RegUnLoadKeyW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
OpenServiceW
SetEntriesInAclW
AllocateAndInitializeSid
GetSecurityDescriptorControl
ReportEventW
LookupPrivilegeDisplayNameA
GetExplicitEntriesFromAclW
DeregisterEventSource
LookupAccountNameW
GetSidIdentifierAuthority
QueryServiceConfigW
OpenEventLogW

Sections

.text
Size: 2KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab85c1688763a35ef874d93a4260050a

Headers

File Characteristics

Imports

ws2_32

version

oleaut32

kernel32

user32

advapi32

Sections

.text Size: 2KB - Virtual size: 223KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 5.5MB - Virtual size: 5.5MB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 2KB - Virtual size: 223KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 5.5MB - Virtual size: 5.5MB

.rsrc
Size: 17KB - Virtual size: 16KB