dc8802fa86e6c25491538bcc808b20dd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dc8802fa86e6c25491538bcc808b20dd_JaffaCakes118
Size

588KB
MD5

dc8802fa86e6c25491538bcc808b20dd
SHA1

240a8462dde302f758258c9cc49c2c80e69d047a
SHA256

cbe1c68330c0a7e94dc70678449399f71ce71ce46ac6d511ce07ae07cd2c6f09
SHA512

b73ac0327153d3ee1fb619368af776cd2cac387c4cebcf1464849c4d96ca3aeb40519e6130adbecda9a9052e7733320022a097b1ab7ca5c99515b1107a57171e
SSDEEP

12288:R6VAhjuT3AEhrlDvgIQ1gu/8M++20zFjQouz1U+Ov2U0kQk3JBS3djTKCENpRg:R6VAhjeAi81J/88dzF5CU+ONQkEhE+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc8802fa86e6c25491538bcc808b20dd_JaffaCakes118

Files

dc8802fa86e6c25491538bcc808b20dd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b355cd3343702883a99f33b91867f94b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACleanup
WSADuplicateSocketA
ioctlsocket
WSAUnhookBlockingHook
sendto
WSAGetServiceClassNameByClassIdW
WSAAsyncGetProtoByNumber
WSAAsyncGetHostByName

advapi32

RegDeleteKeyA
GetSidIdentifierAuthority
ImpersonateSelf
RegReplaceKeyW
QueryServiceConfigA
CloseServiceHandle
IsValidSecurityDescriptor
SetServiceObjectSecurity
SetNamedSecurityInfoW
DeleteService
RegQueryValueA
AddAce
GetSecurityDescriptorDacl

comctl32

ImageList_ReplaceIcon
ord17
ImageList_DrawIndirect
ImageList_SetIconSize

kernel32

VirtualProtect
GetDiskFreeSpaceExA
GlobalReAlloc
DosDateTimeToFileTime
VirtualQuery
CopyFileExW
EnumSystemCodePagesW
GetSystemTimeAdjustment
_hread
ExitProcess
SetConsoleCursorPosition
WritePrivateProfileSectionA
GlobalDeleteAtom
PrepareTape
_lopen
CloseHandle
GetProcessTimes
lstrcmpA
GetDiskFreeSpaceW
SystemTimeToFileTime
FlushFileBuffers
FreeEnvironmentStringsA
ScrollConsoleScreenBufferA

user32

keybd_event
CharNextA
SetUserObjectSecurity
EqualRect
ScrollWindowEx
GetMenuItemRect
EnumDesktopsA
InSendMessage
RegisterWindowMessageW
GetLastActivePopup
CascadeWindows
BeginDeferWindowPos
GetDialogBaseUnits
EnableWindow
LoadMenuA

oleaut32

SafeArrayPutElement

msvcrt

_strupr
_wsplitpath
frexp
rand
freopen
_strdup
_wsopen
_snprintf
tolower
rename
fclose

Sections

.text
Size: 4KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b355cd3343702883a99f33b91867f94b

Headers

File Characteristics

Imports

ws2_32

advapi32

comctl32

kernel32

user32

oleaut32

msvcrt

Sections

.text Size: 4KB - Virtual size: 253KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 296KB - Virtual size: 295KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 4KB - Virtual size: 253KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 296KB - Virtual size: 295KB

.rsrc
Size: 17KB - Virtual size: 16KB