c84f33d02e8efaa49afe56db4575d3ed_JaffaCakes118

General

Target

c84f33d02e8efaa49afe56db4575d3ed_JaffaCakes118
Size

10KB
MD5

c84f33d02e8efaa49afe56db4575d3ed
SHA1

32fc2da1d7e28a98059dce6eff93999c5ae07bfe
SHA256

68d64fd06c96533649a62cc350e3b736b5ecc75e82606e748e92210643d912e7
SHA512

af9d51b57085559d806d5b10749b4050e0fa5fb52c208160b690c9571dcd4872d2c94f40b915bbd02faf138a0ad776e5f694989ebfb2fe56dfcdc62076e0752a
SSDEEP

192:Qw4YZi6M4WUzlMd6LDeJ9jjm7agQ8WY8nDI+9fOlb/AYgcyRzNIxxfNMcos:QyZiPV16LQjmGgQ8/yDt9fOlb/AJcyR5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c84f33d02e8efaa49afe56db4575d3ed_JaffaCakes118

Files

c84f33d02e8efaa49afe56db4575d3ed_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f6f789dd450bec45158838c5181b2f85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Documents\Programming\KRDN\CLIENT\Release\smss.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ws2_32

send
recv
gethostbyname
inet_addr
htons
WSAStartup
WSACleanup
socket
connect
closesocket
inet_ntoa

urlmon

URLDownloadToFileA

shell32

SHGetFolderPathA

kernel32

GetCommandLineA
GetStartupInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetComputerNameA
MoveFileExA
WinExec
GetTempPathA
GetVolumeInformationA
CloseHandle
GetLastError
CreateEventA
Sleep
GetCurrentProcess
ExitProcess
GetSystemInfo
GetSystemTime
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress

user32

wvsprintfA

advapi32

RegSetValueExA
RegCreateKeyA
GetUserNameA
GetTokenInformation
OpenProcessToken

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6f789dd450bec45158838c5181b2f85

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

urlmon

shell32

kernel32

user32

advapi32

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 628B

.reloc Size: 512B - Virtual size: 424B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 628B

.reloc
Size: 512B - Virtual size: 424B