71d2bbef416839235ed7f4875869eff4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

71d2bbef416839235ed7f4875869eff4_JaffaCakes118
Size

64KB
MD5

71d2bbef416839235ed7f4875869eff4
SHA1

8a9b471119df706bf08245e3f60f967049bbb161
SHA256

0ffbff53ad52f368c618af12f37d6ad682d775f58f9352f1eeb71e27dee13fd4
SHA512

080f34b68a8f079dfbe33610ae9e9b7f9a57c8aab3abb1f87b6704654cb40df9a6024085fc8d5f51ebb7f4ea9ae519766830f4ae168ab5e0fb0691a96f2ad308
SSDEEP

1536:StdEbigT/N4GJf9ov8Sv4V1be/K4DcJpkGGogoi+:StdE9/N4cVov8SQVGDtFogoi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71d2bbef416839235ed7f4875869eff4_JaffaCakes118

Files

71d2bbef416839235ed7f4875869eff4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

227fe93eead5548c85f657622ad2e3a9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

inet_ntoa
send
select
connect
setsockopt
socket
WSAStartup
recv
WSAGetLastError
htons
htonl
ioctlsocket
gethostbyname
closesocket

kernel32

GetOEMCP
GetACP
GetCPInfo
HeapAlloc
CloseHandle
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
SetEvent
IsBadStringPtrA
GetCurrentProcessId
GetTickCount
OpenProcess
WaitForSingleObject
GetVersionExA
Sleep
ReadProcessMemory
GetLastError
WriteProcessMemory
GetVersion
HeapReAlloc
VirtualAlloc
CreateEventA
lstrcatA
lstrcpyA
CreateFileMappingA
CreateMutexA
WriteFile
SetFilePointer
GlobalAlloc
GlobalFree
ResetEvent
DuplicateHandle
GetCurrentProcess
LCMapStringA
lstrcmpiA
GetProcAddress
LoadLibraryA
GetStringTypeW
GetStringTypeA
LCMapStringW
FlushFileBuffers
ReadFile
SetStdHandle
lstrlenA
lstrcmpA
CreateThread
GetCommandLineA
GetStartupInfoA
MultiByteToWideChar
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetModuleHandleA
FreeEnvironmentStringsA
TerminateProcess
ExitProcess
GetModuleFileNameA

user32

wsprintfA
SetWindowTextA
PostQuitMessage
DispatchMessageA
TranslateMessage
DefWindowProcA
DestroyWindow
RegisterClassA
MsgWaitForMultipleObjects
MessageBoxA
CreateWindowExA
ShowWindow
LoadCursorA
PeekMessageA

advapi32

RegCloseKey
RegQueryValueExA
SetSecurityInfo
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

227fe93eead5548c85f657622ad2e3a9

Headers

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

Sections

.text Size: 48KB - Virtual size: 46KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 1KB