d6353c79697a417622bdcb9e63981ea8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d6353c79697a417622bdcb9e63981ea8_JaffaCakes118
Size

56KB
MD5

d6353c79697a417622bdcb9e63981ea8
SHA1

07db50a9bfb8015d5cbc1696a3053a55689747bc
SHA256

2df45a95f63aef91c46bba63bd5efab395e719e5e63245559f6b06ad30194bd2
SHA512

2fa585552af94e94331e605ca932e39af8f5d08265c561c325e462d964b2136a4b1c06c864d3f85ae3cb33ebb1bc9d6de44ac8dd47cea8c671bbe8224b9ac09c
SSDEEP

768:N4fYcBdGdAuMUHOg7rspmbk/tMr5hCFT0sj6JARunmfrjpxkw7D/7:lcBdDKPspmbstMVsx0s4MunaFDD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6353c79697a417622bdcb9e63981ea8_JaffaCakes118

Files

d6353c79697a417622bdcb9e63981ea8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f3d56df44feab99b99e767f86a810804

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\My Documents\Visual Studio Projects\phwin\Release\phwinm.pdb

Imports

kernel32

InterlockedDecrement
lstrlenA
GetWindowsDirectoryA
CloseHandle
WriteFile
CreateFileA
lstrcpyA
lstrcatA
GetTickCount
GetLastError
GetCurrentThreadId
GetSystemDirectoryA
ReadFile
SetFilePointer
DeleteCriticalSection
InterlockedIncrement
DeleteFileA
Sleep
SetStdHandle
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetFileType
InitializeCriticalSection
RaiseException
GetVersionExA
GetLocaleInfoA
GetACP
FlushFileBuffers
InterlockedExchange
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
GetCurrentProcess
TerminateProcess
GetProcAddress
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapFree
ExitProcess

user32

CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowPos
wsprintfA
GetLastInputInfo
MessageBoxA
CharLowerA
CharNextA

advapi32

OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenSCManagerA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetMalloc

ole32

CoInitialize
CoUninitialize

ws2_32

WSAStartup
WSACleanup
closesocket
htons
gethostbyname
socket
WSAGetLastError
send
connect
recv

ntdll

RtlUnwind

iphlpapi

GetAdaptersInfo

wininet

InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA
FtpSetCurrentDirectoryA
InternetOpenA
FtpGetFileA
InternetConnectA
InternetReadFile

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f3d56df44feab99b99e767f86a810804

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

ws2_32

ntdll

iphlpapi

wininet

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 8KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 8KB