84d015be0354dccbc39632bd81b02d3a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

84d015be0354dccbc39632bd81b02d3a_JaffaCakes118
Size

24KB
MD5

84d015be0354dccbc39632bd81b02d3a
SHA1

0e4ba554fc2ef5b0667b2c2fba3a4fc5053e7cc4
SHA256

b7422f69d3695235957480b056ae8c6f01eef37fa8b56ddac982b6596552a968
SHA512

6f53da92fca8d8604d3a3cebd1b54d2baea6e38e90196af37cfac20e862efb662944c8d327d3bf0fc6c4d74d3eed076c968c4f9027e2933155900be0132362aa
SSDEEP

384:ldtQVWwXj5f49NXbJ8Tt7kq7qKItyyleZ6Z9yoL9TFdrv8njrQ:TtQVTX1f4D18h7D7wp2qrvr+j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84d015be0354dccbc39632bd81b02d3a_JaffaCakes118

Files

84d015be0354dccbc39632bd81b02d3a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2e6be36e030b8fdb98197e102ae7763f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

x:\project\stool\stool\Release\stool.pdb

Imports

kernel32

GetVersionExA
GetComputerNameA
ExitProcess
WinExec
GetProcessId
GetCurrentProcess
CloseHandle
WriteFile
CreateFileA
GetTempPathA
CreateProcessA
GetLastError
CopyFileA
lstrcmpiA
GetFileAttributesA
GetFullPathNameA
lstrcpynA
GetSystemDirectoryA
GetModuleFileNameA
ExpandEnvironmentStringsA
lstrcatA
CreateMutexA
DeleteFileA
TerminateProcess
OpenProcess
GetCommandLineA
GetCommandLineW
GetModuleHandleA
WaitForSingleObject
SetEvent
CreateEventA
FindClose
FindNextFileA
FindFirstFileA
ReadFile
GetFileSize
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcpyA
lstrlenA
GlobalMemoryStatusEx
GetDriveTypeA
GetDiskFreeSpaceA
HeapFree
GetProcessHeap
HeapAlloc
InitializeCriticalSection
CreateThread
TerminateThread
SwitchToThread
Sleep
EnterCriticalSection
GetTickCount
LeaveCriticalSection
GetShortPathNameA
OutputDebugStringA

user32

wsprintfA
MessageBoxA
ExitWindowsEx
GetSystemMetrics
wvsprintfA

ws2_32

setsockopt
inet_addr
socket
htons
connect
closesocket
recv
send
shutdown
WSAStartup
bind
WSASocketA
sendto
WSAGetLastError
gethostbyname
htonl

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
GetUserNameA
DeleteService
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegDeleteValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

netapi32

Netbios

shell32

SHGetFolderPathA
CommandLineToArgvW

ddraw

DirectDrawCreate

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e6be36e030b8fdb98197e102ae7763f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ws2_32

advapi32

netapi32

shell32

ddraw

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 260KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 260KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 2KB - Virtual size: 1KB