853bc4019b9c4bbba56f168ea156004b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

853bc4019b9c4bbba56f168ea156004b_JaffaCakes118
Size

264KB
MD5

853bc4019b9c4bbba56f168ea156004b
SHA1

416e2d42b30152c3329d9918443f41b851e14816
SHA256

246e71abe24ab94572d697fbf2b73db50665b5f61b5f958e44ab7821af2a567b
SHA512

777238261c27bf35c74bf91ebc8bf080dd2a477c913f840ba0fb78828ba8661380f0f8a4ebbb282d0cf41e931e6db962d6bc606263db6ed669e7bfcd6e523693
SSDEEP

6144:bnEaQC3iA8y0L85JIqXYhHsntwoOaNNCGwDj6VkAB:oaQI49gYQtwoHNCGwSVkAB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
853bc4019b9c4bbba56f168ea156004b_JaffaCakes118

Files

853bc4019b9c4bbba56f168ea156004b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a557734e4e71add78760c5e21ec3fc68

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
FindResourceA
WaitForSingleObject
GetModuleFileNameA
GetVersionExA
Sleep
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
FreeLibrary
GetLastError
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetProcessHeap
HeapCreate
ExitProcess
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
CreateMutexA
GetProcAddress

advapi32

OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
ChangeServiceConfigA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService

dhcpsapi

DhcpAddServer
DhcpCreateClientInfo
DhcpAddSubnetElement
DhcpEnumClasses
DhcpServerRestoreDatabase
DhcpAddMScopeElement
DhcpEnumServers
DhcpEnumSubnetClientsV4
DhcpServerQueryDnsRegCredentials
DhcpCreateOption
DhcpSetOptionInfo
DhcpGetMibInfo
DhcpServerSetConfig
DhcpGetThreadOptions

msrating

ClickedOnRAT

Sections

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h
Size: 5KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 93KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.FbIJK
Size: 5KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 126KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.W
Size: 512B - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a557734e4e71add78760c5e21ec3fc68

Headers

File Characteristics

Imports

kernel32

advapi32

dhcpsapi

msrating

Sections

.edata Size: 5KB - Virtual size: 5KB

.h Size: 5KB - Virtual size: 22KB

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 7KB

.edata Size: 93KB - Virtual size: 118KB

.FbIJK Size: 5KB - Virtual size: 391KB

.data Size: 6KB - Virtual size: 66KB

.edata Size: 126KB - Virtual size: 216KB

.W Size: 512B - Virtual size: 49KB

.rsrc Size: 2KB - Virtual size: 1KB

.edata
Size: 5KB - Virtual size: 5KB

.h
Size: 5KB - Virtual size: 22KB

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 7KB

.edata
Size: 93KB - Virtual size: 118KB

.FbIJK
Size: 5KB - Virtual size: 391KB

.data
Size: 6KB - Virtual size: 66KB

.edata
Size: 126KB - Virtual size: 216KB

.W
Size: 512B - Virtual size: 49KB

.rsrc
Size: 2KB - Virtual size: 1KB