d9d04a45890933ef42a030018cdf43db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d9d04a45890933ef42a030018cdf43db_JaffaCakes118
Size

103KB
MD5

d9d04a45890933ef42a030018cdf43db
SHA1

c9888cec47ce062ec4ac8dda65a9c91a6f7c3f57
SHA256

6f8b9fe5cce266d4b4335a85872b2ccfd64d808ff1e88c31c729823714651542
SHA512

6214845fac79e20e1235a7de4306374319b979cb892f64ee8eea2b2d58962d20c7b7d236506bd20f9c19397aa265e5addbfab27c71fdd4027a469bea8495ad97
SSDEEP

3072:OylVl83culQ3L6GiEE4+0oG9Q5T8GsEHpKFQ:OylV53L6Gib0oGcgGsEJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9d04a45890933ef42a030018cdf43db_JaffaCakes118

Files

d9d04a45890933ef42a030018cdf43db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ffe312e2312642b7506cb93eb8cf72c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
StartServiceCtrlDispatcherA
GetUserNameA
RegQueryValueExA
RegCloseKey
RegisterServiceCtrlHandlerA
SetServiceStatus

ws2_32

send
select
__WSAFDIsSet
recv
ioctlsocket
accept
htonl
htons
bind
socket
connect
closesocket
WSASetLastError
WSAStartup
WSACleanup
ntohl
inet_addr
gethostbyname
listen

kernel32

ReadFile
VirtualAlloc
FileTimeToLocalFileTime
GetLocalTime
GetStartupInfoA
RtlUnwind
HeapAlloc
GetCurrentDirectoryA
GetACP
GetStdHandle
GetDriveTypeA
CreateToolhelp32Snapshot
CompareStringW
WriteFile
OutputDebugStringA
SetHandleCount
PeekNamedPipe
GetVersionExA
CreatePipe
CompareStringA
GetComputerNameA
FindFirstFileA
UnhandledExceptionFilter
HeapReAlloc
SuspendThread
ExitProcess
CreateFileA
GetModuleFileNameA
SetEnvironmentVariableA
FindClose
CopyFileA
SetStdHandle
FlushFileBuffers
DeleteFileA
GetFileType
GetStringTypeW
GetLastError
VirtualFree
GetStringTypeA
LCMapStringW
GetFileSize
GetLogicalDrives
LCMapStringA
LoadLibraryA
GetCurrentProcess
Process32First
GetTimeZoneInformation
GetSystemTime
GetEnvironmentStrings
GetOEMCP
HeapDestroy
GetProcAddress
OpenProcess
Sleep
FreeEnvironmentStringsW
Process32Next
CreateThread
TerminateProcess
GetEnvironmentVariableA
GetEnvironmentStringsW
FindNextFileA
CreateProcessA
ResumeThread
HeapFree
GetCPInfo
HeapCreate
WideCharToMultiByte
GetCommandLineA
GetModuleHandleA
FreeEnvironmentStringsA
FileTimeToSystemTime
TerminateThread
CloseHandle
SetFilePointer
SetCurrentDirectoryA
WaitForSingleObject
GetVersion
MultiByteToWideChar

Sections

.text
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffe312e2312642b7506cb93eb8cf72c3

Headers

File Characteristics

Imports

advapi32

ws2_32

kernel32

Sections

.text Size: 50KB - Virtual size: 52KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 46KB - Virtual size: 56KB

.rsrc Size: 1024B - Virtual size: 4KB

.text
Size: 50KB - Virtual size: 52KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 46KB - Virtual size: 56KB

.rsrc
Size: 1024B - Virtual size: 4KB