83a0654deb56a8adb451828e4c4ee3b3_JaffaCakes118

General

Target

83a0654deb56a8adb451828e4c4ee3b3_JaffaCakes118
Size

116KB
MD5

83a0654deb56a8adb451828e4c4ee3b3
SHA1

1395af50a0b8f4a42236ca90d453f0bd9bbf5306
SHA256

3f3233d11232e927be340e2b11ed217c4f72d3c43cb7efff4062afab784e6978
SHA512

60beb800777057e14ccb8e27ec66da1260d066c300a9e61582a08d1b9dc56a9ef37908a806d71e05a07eebc9df15568f75577f4eb66405fb75ed17392dca07f7
SSDEEP

3072:bgwi/erT0jPSEIwwnpRM5f1o/zoI7h+aS1Gk:swi/erom5wwnpaf0zo0naGk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83a0654deb56a8adb451828e4c4ee3b3_JaffaCakes118

Files

83a0654deb56a8adb451828e4c4ee3b3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d947623612a3d7773633c5cfaf33b86c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
Sleep
ReadFile
PeekNamedPipe
WriteFile
CreatePipe
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
CreateThread
GetStdHandle
FreeConsole
WriteConsoleA
CreateFileA
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
LCMapStringW
LCMapStringA
LoadLibraryA
GetProcAddress
GetStringTypeW
GetStringTypeA
SetFilePointer
SetStdHandle
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
HeapFree
HeapAlloc
ExitProcess
Beep
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
WideCharToMultiByte
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
FlushFileBuffers
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
SetEndOfFile

wsock32

__WSAFDIsSet
select
listen
getsockname
recvfrom
accept
WSASetLastError
socket
setsockopt
bind
connect
htons
getservbyport
ntohs
getservbyname
ioctlsocket
gethostbyname
inet_addr
gethostbyaddr
WSAGetLastError
WSAStartup
WSACleanup
closesocket
recv
send

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d947623612a3d7773633c5cfaf33b86c

Headers

File Characteristics

Imports

kernel32

wsock32

Sections

.text Size: 56KB - Virtual size: 52KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 13KB

.idata Size: 40KB - Virtual size: 39KB

.text
Size: 56KB - Virtual size: 52KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 13KB

.idata
Size: 40KB - Virtual size: 39KB