a4e999324a80660e8815600484849394_JaffaCakes118

General

Target

a4e999324a80660e8815600484849394_JaffaCakes118
Size

48KB
MD5

a4e999324a80660e8815600484849394
SHA1

e17cd94a8ddf0bff1cc9333f7557901154cd9580
SHA256

c60220137c5aa296024a1d56b3e6376d60d05bba521262bdcf8dbd1558e1df75
SHA512

0d49ea52be54bf41148a62d93cb907cef40e59803853f35a9544fbd1841d88e55d0ae3120593a7661b730f502074447172eee57d409e70987623cf8ca44e4a09
SSDEEP

768:57GSmGpYAtI0+QwwhXuobYqO/SMXNPLRxR77vhHDBxKY+f0ab:5GSmGpfI/QwwNbA/SMdPLlHvhFUb0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4e999324a80660e8815600484849394_JaffaCakes118

Files

a4e999324a80660e8815600484849394_JaffaCakes118
.dll windows:4 windows x86 arch:x86

36c3d6ab8036dbfe49cecba87222256b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

h:\HOSTING\Netcat_DEDIC\NOVIE_CHUVAKI_FROM_NOVA\FINAL_EXPLOITS1\Release 1.2\bot\netClient\Release\netClient.pdb

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
VirtualQuery
GetSystemInfo
VirtualProtect
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
ExitProcess
GetCurrentThreadId
TlsSetValue
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsFree
SetLastError
TlsGetValue
GetLastError
TlsAlloc
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
SetStdHandle
RtlUnwind
HeapSize
GetLocaleInfoA
GetStringTypeA

wsock32

WSAStartup
WSACleanup
socket
htons
connect
send
recv
closesocket
gethostbyname

wininet

InternetGetConnectedState

Exports

Exports

dialog
download
getState

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36c3d6ab8036dbfe49cecba87222256b

Headers

File Characteristics

PDB Paths

Imports

kernel32

wsock32

wininet

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 3KB