94d821524419a792bc44682849e0f781_JaffaCakes118

General

Target

94d821524419a792bc44682849e0f781_JaffaCakes118
Size

31KB
MD5

94d821524419a792bc44682849e0f781
SHA1

24dc9433b4df595b6193a6dcefcfdaff5ad094ad
SHA256

e079e057ae0d6b9a1c9e8c57e5cd269b89eee39728dec52c60bf7280f8f03418
SHA512

41976e3cd15395ac59026c326fbbf4db38376b723dba5eb2232e64400612c4a2fd274dcb90ed492df99030109599286a67b6e84c30471b3b872a3f62a6fa09d6
SSDEEP

384:ZPD7Rb5b3xNnM2Ynsuer9/6g9RqYZvyLQ5NVMqPLAvQQiUPmi:Z/RH7EsuexSg9MYMUAYVUD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94d821524419a792bc44682849e0f781_JaffaCakes118

Files

94d821524419a792bc44682849e0f781_JaffaCakes118
.dll windows:4 windows x86 arch:x86

97ca935df2c66b88459e4bd4e047fc79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recv
__WSAFDIsSet
select
ioctlsocket
inet_ntoa
ntohs
setsockopt
socket
connect
closesocket
WSASetLastError
WSAStartup
WSACleanup
htons
inet_addr
send
gethostbyname

msvcrt

strstr
_stricmp
sprintf
atoi
free
_adjust_fdiv
rand
_strnicmp
malloc
strncpy
_initterm

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
GetUserNameA

kernel32

CreateFileA
TerminateThread
GetLogicalDrives
CreateProcessA
CreatePipe
GetCurrentDirectoryA
Process32Next
SetFilePointer
WaitForSingleObject
WriteFile
SetCurrentDirectoryA
FindFirstFileA
ReadFile
SuspendThread
GetEnvironmentVariableA
GetDriveTypeA
GetComputerNameA
OpenProcess
TerminateProcess
FindClose
CreateToolhelp32Snapshot
FindNextFileA
PeekNamedPipe
DeleteFileA
FileTimeToLocalFileTime
GetLocalTime
CreateThread
CopyFileA
GetFileSize
Process32First
Sleep
GetVersionExA
FileTimeToSystemTime
ResumeThread
CloseHandle
GetLastError

Exports

Exports

ServiceMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 746B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97ca935df2c66b88459e4bd4e047fc79

Headers

File Characteristics

Imports

ws2_32

msvcrt

advapi32

kernel32

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 1024B - Virtual size: 746B

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 1024B - Virtual size: 746B