81de30ff7f02b38310e70c8d46102ecf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

81de30ff7f02b38310e70c8d46102ecf_JaffaCakes118
Size

92KB
MD5

81de30ff7f02b38310e70c8d46102ecf
SHA1

85ade9820e93b4970d2203febd4d36ba08a1ff7e
SHA256

96fb3e13fc5e9eceeecb52dd1de155bf361d516531b5f4510633a298a8c69cc0
SHA512

2f88b73f928566deef28c1c95004b8eb4e7b34290f9c097bde88092ac0c47e652d34d0901cad802b4cefc238461ef5b5a7fc091d3348b0515555fbbe8916cea6
SSDEEP

1536:LD4fd/7Loy6Z021guarvMaQnvG3gv8vgHkAh/AKNmRutQQ:X4fePZ02180dGva/tAutQQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81de30ff7f02b38310e70c8d46102ecf_JaffaCakes118

Files

81de30ff7f02b38310e70c8d46102ecf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1a01951379db42bfb77ee8198e631b85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

__WSAFDIsSet
select
recv
send
listen
getsockname
recvfrom
accept
WSASetLastError
socket
setsockopt
bind
connect
htons
getservbyport
ntohs
getservbyname
ioctlsocket
gethostbyname
inet_addr
gethostbyaddr
shutdown
closesocket
WSAGetLastError
WSAStartup
WSACleanup

kernel32

TlsGetValue
GetNumberOfConsoleInputEvents
PeekConsoleInputA
DuplicateHandle
CreateFileA
CloseHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
GetLocaleInfoA
HeapSize
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
GetStdHandle
FreeConsole
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
ExitProcess
Sleep
RtlUnwind
HeapAlloc
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
DeleteCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
GetLastError
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetEndOfFile
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
MultiByteToWideChar
CompareStringW

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a01951379db42bfb77ee8198e631b85

Headers

File Characteristics

Imports

wsock32

kernel32

Sections

.text Size: 60KB - Virtual size: 56KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 176B

.text
Size: 60KB - Virtual size: 56KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 176B