d160e25c57ec928076a475f1a8885f0d_JaffaCakes118

General

Target

d160e25c57ec928076a475f1a8885f0d_JaffaCakes118
Size

28KB
MD5

d160e25c57ec928076a475f1a8885f0d
SHA1

2a1d49ef0734fb47133ddf61b90000f887e97d9d
SHA256

0fa29bb6a013d5a79ec9086a7bbb521af5899c8ec9cb35d741ed393c841f41d9
SHA512

85eeb6a11c83b88bb96091a3168f37208f679ba1baba00e499e0847fe58cead7587cb751863ac367aa05e4e35ea7b7f2e9af67797baa0196602a0b0c8510d826
SSDEEP

384:ygf1E4aDVChV8TorfNK+gAsmjU0ElRqZSPzK42LmgIgHdX:VE40Q7nrVeAvY0K3PR25Bd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d160e25c57ec928076a475f1a8885f0d_JaffaCakes118

Files

d160e25c57ec928076a475f1a8885f0d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4326f860f079cee6f5ab47f77554af04

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetCurrentProcessId
GetFileSize
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetTempPathA
GlobalAlloc
GlobalFree
LoadLibraryA
LoadLibraryExA
OpenProcess
Process32First
Process32Next
ReadFile
FlushFileBuffers
RtlZeroMemory
SetFilePointer
SetLocalTime
Sleep
TerminateProcess
Thread32First
Thread32Next
VirtualAllocEx
VirtualProtectEx
WinExec
WriteFile
WriteProcessMemory
lstrcatA
lstrcpyA
lstrlenA
DeleteFileA
DeviceIoControl
CreateToolhelp32Snapshot
CreateThread
CreateRemoteThread
CreateProcessA
CreateMutexA
CreateFileA
CopyFileA
CloseHandle

ws2_32

send
WSAStartup
connect
gethostbyname
recv
socket
closesocket

advapi32

CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle

imagehlp

CheckSumMappedFile

user32

wsprintfA

ntdll

NtQuerySystemInformation
ZwResumeThread

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4326f860f079cee6f5ab47f77554af04

Headers

File Characteristics

Imports

kernel32

ws2_32

advapi32

imagehlp

user32

ntdll

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 14KB - Virtual size: 13KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 14KB - Virtual size: 13KB