a3e9912b8ddb9ef5bcd8e9b90c24bfb3_JaffaCakes118

General

Target

a3e9912b8ddb9ef5bcd8e9b90c24bfb3_JaffaCakes118
Size

84KB
MD5

a3e9912b8ddb9ef5bcd8e9b90c24bfb3
SHA1

a8ded3a7ef1093a5e1c69c2165ba52735828f27a
SHA256

7dd5e6abc9fc8c3a99534d23a932b3b67a0d5af3d21a33820d01d6e6c8667959
SHA512

952bee9677039e4b93a13c2d8f85ddc22fea46c4a5b3c1ee315650e0d51b661da4f4667a49aa4d9c95ac34ad5ffb31851114443bf46a61d7a2aa5ba50025c52f
SSDEEP

1536:tWaIqxVhMODEIrccQJPmcaYDXUUNX5lcdyvpcUu5LNQZt/eoZ:qqxLMOIIr6ZPaYj7Z5lcMpcUu5LNG/eO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3e9912b8ddb9ef5bcd8e9b90c24bfb3_JaffaCakes118

Files

a3e9912b8ddb9ef5bcd8e9b90c24bfb3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

972d5a7597dbb90494fada153be16dcb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
Sleep
TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
CreateFileA
SetStdHandle
SetConsoleCtrlHandler
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileType
SetHandleCount
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
SetFilePointer
InterlockedIncrement
GetLastError
MoveFileA
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
SetEndOfFile

user32

TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
TranslateMessage
RegisterClassExA
LoadCursorA
LoadIconA
SetTimer
DispatchMessageA
LoadStringA
GetForegroundWindow
GetWindowTextA
DestroyWindow
PostQuitMessage
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow

shell32

ShellExecuteA

wsock32

send
recv
connect
htons
closesocket
gethostbyname
ioctlsocket
socket
WSACleanup
WSAStartup

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

972d5a7597dbb90494fada153be16dcb

Headers

File Characteristics

Imports

kernel32

user32

shell32

wsock32

Sections

.text Size: 64KB - Virtual size: 60KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 64KB - Virtual size: 60KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB