c120093b9c7f399de733db5f5afc9af2_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c120093b9c7f399de733db5f5afc9af2_JaffaCakes118
Size

41KB
MD5

c120093b9c7f399de733db5f5afc9af2
SHA1

53dbd2e356ccaf1c513a803b669bf7e6a9df9a79
SHA256

2f62c0520a89de65e8b805a46cc8504cc6166586b3ff28d55ed1e2abee821ecc
SHA512

4f8676b6684cf5fba2badb6b004fe0c5f7c0eb4fea4c8914475baef3993d61e5a59b9dbf8f086d8e9b1b7639ae43642f649f4e2f787b1e37c4eb777838ae0cdf
SSDEEP

768:U9AaormLtAACszJmaa/7t/BrVnZj98yQuE2Y79XZD8g5VazgHF4KE:U9AaormLtAACszJm//7t/BrVnZj98yQM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c120093b9c7f399de733db5f5afc9af2_JaffaCakes118

Files

c120093b9c7f399de733db5f5afc9af2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fa6fd48d440b3f5cd4dd8d71cf2b460d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
GetUserNameA
OpenProcessToken
OpenThreadToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

kernel32

AddAtomA
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
FindAtomA
FreeLibrary
GetAtomNameA
GetCurrentProcess
GetCurrentThread
GetFileAttributesA
GetFileSize
GetLastError
GetModuleFileNameA
GetProcAddress
GetTempPathA
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
WaitForSingleObject
WinExec
WriteFile
lstrcatA
lstrlenA

msvcrt

_itoa
_strlwr
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
atoi
exit
fflush
fprintf
free
malloc
memcpy
memmove
memset
rand
signal
strcat
strcmp
strcpy
strlen
strncat

shell32

ShellExecuteA

wsock32

WSACleanup
WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
ioctlsocket
recv
send
sendto
socket

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 557B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa6fd48d440b3f5cd4dd8d71cf2b460d

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

shell32

wsock32

Sections

.text Size: 27KB - Virtual size: 27KB

.data Size: 8KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 592B

.bss Size: - Virtual size: 131KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 557B

.text
Size: 27KB - Virtual size: 27KB

.data
Size: 8KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 592B

.bss
Size: - Virtual size: 131KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 557B