6768289c3e08430838d0f072fbcf1658_JaffaCakes118

General

Target

6768289c3e08430838d0f072fbcf1658_JaffaCakes118
Size

48KB
MD5

6768289c3e08430838d0f072fbcf1658
SHA1

9576e39d0268a0c317ff23978f10415382215bb4
SHA256

7407b861e8d04573728156f48fd0f2ebd493fa2631edc02552bae719d51e6c24
SHA512

eef359f605ec2d2b545d54af3ae2f0c6dcf8b8d529c2b3a4832b9e900d44fcf9e00422eba9928c5f001c2323f08e4fb4708e785c36052615416047754458aff4
SSDEEP

1536:SwD/ZpHeN4PnVpdFzHAU0B2vqngcSGCXxB:tXHeuPn3dFzg1B2vqn7SGChB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6768289c3e08430838d0f072fbcf1658_JaffaCakes118

Files

6768289c3e08430838d0f072fbcf1658_JaffaCakes118
.exe windows:4 windows x86 arch:x86

952c8331fa29598009f10f587279208b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
GetCurrentProcess
VirtualAlloc
ResumeThread
SetThreadContext
GetThreadContext
CreateProcessA
ReleaseMutex
WaitForSingleObject
lstrlenA
ExitProcess
VirtualFree
GetComputerNameA
GetVolumeInformationA
TerminateThread
CreateMutexA
LoadLibraryA
CopyFileA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryExA
SetPriorityClass
GetCurrentProcessId
CreateThread
ExitThread
GetTickCount
Sleep
lstrcpyA
lstrcatA
CreateFileA
WriteFile
DeleteFileA
MultiByteToWideChar
QueryDosDeviceA
DeviceIoControl
CloseHandle
GetVersion
lstrcmpA
CreateFileW

user32

wsprintfA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegCreateKeyA
RegDeleteValueA
RegCloseKey
OpenSCManagerA
CreateServiceA
OpenServiceA
CloseServiceHandle
StartServiceA
DeleteService

ws2_32

inet_ntoa
WSAStartup
socket
sendto
htons
connect
send
inet_addr
gethostbyname
htonl
closesocket
gethostname
setsockopt

wininet

InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
InternetOpenA

dnsapi

DnsQuery_A
DnsRecordListFree

ntdll

NtQuerySystemInformation

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

952c8331fa29598009f10f587279208b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

wininet

dnsapi

ntdll

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 7KB - Virtual size: 12KB

.bdata Size: 20KB - Virtual size: 20KB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 7KB - Virtual size: 12KB

.bdata
Size: 20KB - Virtual size: 20KB