7853fa656ffaa660199397b5a06fed8f_JaffaCakes118

General

Target

7853fa656ffaa660199397b5a06fed8f_JaffaCakes118
Size

118KB
MD5

7853fa656ffaa660199397b5a06fed8f
SHA1

245ec3473e8923dab8fd1bdbe6c319dff9056800
SHA256

614598dab0d5787d3ece00cfef1deaf09a4507373296917a184355cf34c8bb8c
SHA512

de94b086b9ba7c28ec607054c5076766cf9777ad121e98a5e9075e41fa990ef2e60fc246e824f108a1c548144f903b9af905160af35fcc1354f279bedcb16274
SSDEEP

3072:dSKf2N9xxjcgjQFrUBX/7RVIc7BFNROGgN:8KfUjcOWrY/7jxK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7853fa656ffaa660199397b5a06fed8f_JaffaCakes118

Files

7853fa656ffaa660199397b5a06fed8f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

462f63682626cfc5c88f45cce550cbee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryW
DeleteFileW
CreateFileMappingA
InterlockedExchange
SetUnhandledExceptionFilter
GetStartupInfoA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetLastError
TerminateProcess
GetModuleHandleA
VirtualAlloc
GetProcAddress
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceCounter

advapi32

RegOpenKeyExA
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegQueryValueExW
WmiMofEnumerateResourcesA

wsock32

GetAddressByNameA
GetNameByTypeA
sethostname
SetServiceA
GetTypeByNameA
dn_expand
WSARecvEx
GetServiceA
NPLoadNameSpaces
gethostbyname
TransmitFile
EnumProtocolsA

Sections

.textbss
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

462f63682626cfc5c88f45cce550cbee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

wsock32

Sections

.textbss Size: - Virtual size: 108KB

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 53KB - Virtual size: 53KB

.rsrc Size: 6KB - Virtual size: 6KB

.textbss
Size: - Virtual size: 108KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 53KB - Virtual size: 53KB

.rsrc
Size: 6KB - Virtual size: 6KB