b5b99e89ef9df8b920a1e2f6344dea94_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b5b99e89ef9df8b920a1e2f6344dea94_JaffaCakes118
Size

15KB
MD5

b5b99e89ef9df8b920a1e2f6344dea94
SHA1

31c92a7aeb3b31e6faec47689468aba3202aa789
SHA256

171842bdf70303dda9606918b7d99113b28c1ff5963d34d801eb2c57befcd78e
SHA512

de5c5bf001fcaf3d09665f2da0628c84de2ccd07ce5fc9aecad1f7726dc18489ec120dd0d54c0fbed6b9975d88e4f491e91d23964bba8186b01b5be78b405264
SSDEEP

384:fetvujQYIQq/W14dU1eREQSHh3KCInFG8A:fSGjQYBuWOBREQSB3Gnc8A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5b99e89ef9df8b920a1e2f6344dea94_JaffaCakes118

Files

b5b99e89ef9df8b920a1e2f6344dea94_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ec8eb645e25b568bbac8f4762e124681

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

_exit
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
strstr
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
strchr
_cexit
__getmainargs
_amsg_exit
sprintf
malloc
srand
rand
_beginthread
toupper
memcpy
getenv
_snprintf
calloc
free
memset
ceil
_stricmp
atoi

ws2_32

recv
send
socket
ntohl
connect
inet_addr
htons
bind
listen
accept
select
__WSAFDIsSet
closesocket
WSAStartup
gethostname
gethostbyname
inet_ntoa

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

ntdll

NtQuerySystemInformation
ZwSystemDebugControl

kernel32

ExitProcess
GetLastError
CloseHandle
GetCurrentProcess
GetProcessAffinityMask
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
GetLocaleInfoA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GetShortPathNameA
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
EncodePointer
SetUnhandledExceptionFilter
DecodePointer
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
CopyFileA
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateThread
Sleep
GetCurrentProcessId
DeleteFileA
CreateMutexA
SetErrorMode

advapi32

RegCreateKeyExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec8eb645e25b568bbac8f4762e124681

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

ws2_32

wininet

ntdll

kernel32

advapi32

shell32

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 932B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 1024B - Virtual size: 878B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 932B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 878B