78a1cd0575136c08a7f988f9dfd11af8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

78a1cd0575136c08a7f988f9dfd11af8_JaffaCakes118
Size

9KB
MD5

78a1cd0575136c08a7f988f9dfd11af8
SHA1

eba04110e5991a7e5f8d8e4d7f26f95356accd0e
SHA256

1c10c8c35c0ccfeb239472ac3c3a197b31b7a46c4a346c195c974784d7f76951
SHA512

209dc234019a91ba9f8c233e53fcea50b529c63b3920ea6ab168adbc47dfddacb41acc9b6cf595f4fcf48c06c2cd83be3cff1de107c898d2794c9148f0cd0c29
SSDEEP

192:0pipDMSR59mquAYhCxi/xYw/LkcJvJY/Eo2j9xez8+IwKyAZA7C01U4fWMKZ/:0pOB59mqu+qrTxJk2xU8+SyoAG01zKt

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/orkdec_files.dll
unpack001/orkdec_files_loader.exe

Files

78a1cd0575136c08a7f988f9dfd11af8_JaffaCakes118
.zip
orkdec_files.c
orkdec_files.dll
.dll windows:4 windows x86 arch:x86

faa7ae816026135fc61c4d8041bf5f22

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetCurrentProcess
GetModuleHandleA
GetProcAddress
ReadProcessMemory
WriteProcessMemory

msvcrt

_getcwd
__dllonexit
_errno
_iob
calloc
exit
fclose
fflush
fopen
fprintf
free
fwrite
malloc
memcpy
sprintf
time

user32

MessageBoxA

Exports

Exports

call
fd
find_bytes
get_current_section
jmp
mm
orkdec_files
orkdec_init
orkdec_off
parse_PE

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 192B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
orkdec_files.h
orkdec_files_loader.c
orkdec_files_loader.exe
.exe windows:4 windows x86 arch:x86

1198b00ff41f099b5c428bafb8aea91a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CreateProcessA
CreateRemoteThread
ExitProcess
FormatMessageA
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
LocalFree
ResumeThread
SetUnhandledExceptionFilter
VirtualAllocEx
WriteProcessMemory

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
atexit
exit
fgetc
fwrite
printf
puts
signal
strlen
tolower

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

faa7ae816026135fc61c4d8041bf5f22

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 20B

.rdata Size: 1024B - Virtual size: 688B

.bss Size: - Virtual size: 192B

.edata Size: 512B - Virtual size: 248B

.idata Size: 1024B - Virtual size: 816B

.reloc Size: 512B - Virtual size: 204B

1198b00ff41f099b5c428bafb8aea91a

Headers

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 52B

.rdata Size: 1024B - Virtual size: 560B

.bss Size: - Virtual size: 96B

.idata Size: 1024B - Virtual size: 948B

.text
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 20B

.rdata
Size: 1024B - Virtual size: 688B

.bss
Size: - Virtual size: 192B

.edata
Size: 512B - Virtual size: 248B

.idata
Size: 1024B - Virtual size: 816B

.reloc
Size: 512B - Virtual size: 204B

.text
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 52B

.rdata
Size: 1024B - Virtual size: 560B

.bss
Size: - Virtual size: 96B

.idata
Size: 1024B - Virtual size: 948B