7868c3864629cc33d522262f62405e60_JaffaCakes118

General

Target

7868c3864629cc33d522262f62405e60_JaffaCakes118
Size

88KB
MD5

7868c3864629cc33d522262f62405e60
SHA1

7b0988ac4bcaf3ac843fcedcdba6d13b29f15991
SHA256

ca47f0f54a349daadf10078c79597f6aefd06599e746bac12b1b23426e042da5
SHA512

e0689c8134d099ac0e25fa395fcd8dc2242e633d35828c851cb136e53348e0f49a97cb7cb5c4252bfb847d3a98e289fe15d2cbf8b99785d890f487983d3f6c0c
SSDEEP

1536:VofObGf6V3sBluGCeRZWIA/5YCp/+eEXBUt8:VofHJ/KdRYuTeUt8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7868c3864629cc33d522262f62405e60_JaffaCakes118

Files

7868c3864629cc33d522262f62405e60_JaffaCakes118
.exe windows:4 windows x86 arch:x86

255f6fc911c1fbbee3f19a46c9684aa8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Misugi\Mes documents\Visual Studio 2005\Projects\C#\Win32\myTrojan\release\myServer.pdb

Imports

kernel32

CloseHandle
ExitProcess
GetFileAttributesA
GetModuleFileNameA
Sleep
SetEndOfFile
WriteConsoleW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetCPInfo
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
ReadFile
LoadLibraryA
CreateFileA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

255f6fc911c1fbbee3f19a46c9684aa8

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

Sections

.text Size: 64KB - Virtual size: 61KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 176B

.text
Size: 64KB - Virtual size: 61KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 176B