7299898445a2f5e07703ba6384770f87_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

7299898445a2f5e07703ba6384770f87_JaffaCakes118
Size

104KB
MD5

7299898445a2f5e07703ba6384770f87
SHA1

b001583c6f90421e702da1620a077fcecb6a23e5
SHA256

ebc7b88e4f531c61ae17273e27067d14ba8d1254f1dc065da0009f3ca8e1b58e
SHA512

25f0260b790fd9f38e7ac8de3ba97ed3839ed701d110dd6f4aa474be82211ed1b3b37f95c92eb05718941461a489105643b836d7bc9f9ffbd8932670866a480d
SSDEEP

1536:XIT7lsVzLAdJQclCjy6qXkFAFLBLtRLNSQRUbe:XN+HRRLNSQRUy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7299898445a2f5e07703ba6384770f87_JaffaCakes118

Files

7299898445a2f5e07703ba6384770f87_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9b5ddf34fd58450d42ef9bda03f407c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\prj\bitynike\release\bitynike.pdb

Imports

wininet

InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetQueryDataAvailable
InternetOpenA
InternetConnectA
InternetReadFile

netapi32

Netbios

urlmon

URLDownloadToFileA

kernel32

SetFilePointer
RtlUnwind
WriteConsoleA
SetStdHandle
GetLastError
InterlockedExchange
GetProcAddress
CompareStringA
LoadLibraryA
CompareStringW
FreeLibrary
GetVersionExA
GetConsoleOutputCP
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceA
FindResourceExA
Sleep
LoadLibraryW
RaiseException
GetLocaleInfoA
WriteConsoleW
SetEnvironmentVariableA
CreateFileA
CloseHandle
FlushFileBuffers
GetThreadLocale
GetCommandLineA
GetStringTypeW
GetConsoleMode
VirtualAlloc
GetModuleHandleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetTimeZoneInformation
GetLocalTime
HeapReAlloc
GetCurrentThreadId
GetStringTypeA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSection
GetConsoleCP

user32

UnregisterClassA

advapi32

RegSetValueExA
RegisterServiceCtrlHandlerExA
StartServiceCtrlDispatcherA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
SetServiceStatus

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Exports

Exports

ServiceMain
_HandlerEx@16

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b5ddf34fd58450d42ef9bda03f407c1

Headers

File Characteristics

PDB Paths

Imports

wininet

netapi32

urlmon

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 60KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 64KB - Virtual size: 60KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 6KB