6a916c4221f9b074bda7ce5a7c076af5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6a916c4221f9b074bda7ce5a7c076af5_JaffaCakes118
Size

52KB
MD5

6a916c4221f9b074bda7ce5a7c076af5
SHA1

d6172c889dac856b032ba2e65e2db0882db37480
SHA256

5a2b4dffebb2a4983da3826c8edd56add0527e328e458ca16aaac65538fe74a6
SHA512

8bfcb11c99f28c8a42cc6ff2ef062141e61409772288a653c7430bbbabacb12c0029055e950dfa1b4ce9c4fbdf81640ed7d69481de00b964eeafdf497b8e0531
SSDEEP

768:OiLymh7Ju0etasg5VI3dNad0amZsoptEyuXR/YiIH6N+15xtO1T31ezCYI0XETZy:PLyMajHW5d+/owzyTgB3b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a916c4221f9b074bda7ce5a7c076af5_JaffaCakes118

Files

6a916c4221f9b074bda7ce5a7c076af5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1005a6325421da448a2536e91b97fbd2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
WriteFile
DeviceIoControl
GetVersionExA
LoadLibraryA
GetModuleHandleA
HeapFree
ExitThread
DeleteFileA
LoadLibraryExA
TerminateThread
GetModuleFileNameA
ExitProcess
GetLastError
CreateMutexA
GetProcAddress
FreeLibrary
GlobalFree
CreateThread
GetCurrentProcessId
lstrcmpA
Sleep
CreateFileA
GetFileAttributesA
GetProcessHeap
HeapAlloc
GetTickCount
GetCurrentProcess
GetSystemDirectoryA
CloseHandle
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetSystemTimeAsFileTime
RtlUnwind
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte

user32

GetDesktopWindow
wsprintfA

advapi32

RegCreateKeyA
RegSetValueExA
RegCloseKey
StartServiceA
OpenSCManagerA
LockServiceDatabase
OpenServiceA
ChangeServiceConfigA
UnlockServiceDatabase
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CreateServiceA

shell32

SHFileOperationA
ShellExecuteA

ws2_32

inet_addr
WSAConnect
inet_ntoa
bind
listen
accept
connect
shutdown
closesocket
recv
socket
setsockopt
sendto
send
WSAStartup
WSASocketA
WSACleanup
gethostbyname
htons

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

iphlpapi

GetNetworkParams

ntdll

memcpy
strlen
strcat
memset
NtQuerySystemInformation
_chkstk

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1005a6325421da448a2536e91b97fbd2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

wininet

iphlpapi

ntdll

Sections

.text Size: 44KB - Virtual size: 43KB

.data Size: 7KB - Virtual size: 10KB

.text
Size: 44KB - Virtual size: 43KB

.data
Size: 7KB - Virtual size: 10KB