c205bbcd7f302e0e6901b33e8c8ab7d6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c205bbcd7f302e0e6901b33e8c8ab7d6_JaffaCakes118
Size

86KB
MD5

c205bbcd7f302e0e6901b33e8c8ab7d6
SHA1

948143f073defab1982c865d82f1ba6318e03616
SHA256

5001d5a3835fcf87dac10f6ea1208c30dda7830677ede7befaff5f8de0461f01
SHA512

c00b014061882074e7ff25e970c24b9bb48af2ea11c0e9240149ce16b91d36626077f043335b075093ecafd7172d4f93d19178a0330f6f0495d5b7f0b242ab20
SSDEEP

1536:bsiQx85vJ94aqSpBSP2Z9mRMq7HRekdtJf+gfKLXCj5Vl:bU8x/pIecTRzGHLXCj5Vl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c205bbcd7f302e0e6901b33e8c8ab7d6_JaffaCakes118

Files

c205bbcd7f302e0e6901b33e8c8ab7d6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4b60b689030c77216df687e19ad41be6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ioctlsocket
gethostbyname
select
WSAStartup
setsockopt
inet_addr
sendto
WSACleanup
htons
socket
connect
send
closesocket
getsockname
recv

user32

BlockInput
keybd_event
ShowWindow
VkKeyScanA
OpenClipboard
SetFocus
wsprintfA
SetClipboardData
CloseClipboard
EmptyClipboard

kernel32

HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
IsValidCodePage
CloseHandle
CreateProcessA
ExitProcess
GetTempPathA
GetTickCount
GetVersionExA
Sleep
ReleaseMutex
CreateMutexA
GetModuleFileNameA
SetFileAttributesA
GetLastError
CopyFileA
lstrcmpiA
OpenMutexA
SetErrorMode
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
CreateFileA
TerminateThread
WaitForSingleObject
CreateThread
RaiseException
ExitThread
IsDebuggerPresent
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
FlushFileBuffers
HeapAlloc
GetCommandLineA
GetStartupInfoA
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle

advapi32

RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA
RegOpenKeyA

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
SysAllocString
VariantClear

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b60b689030c77216df687e19ad41be6

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

user32

kernel32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 66KB - Virtual size: 65KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 6KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 66KB - Virtual size: 65KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 6KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 436B