f6eb5f0355df4e21586f09843955bf9d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f6eb5f0355df4e21586f09843955bf9d_JaffaCakes118
Size

605KB
MD5

f6eb5f0355df4e21586f09843955bf9d
SHA1

af626e1d3a96583a513971f13b1c5f0027e9e911
SHA256

3a82325ae9d68be586f81d99aa7dd9b0dbd72194c59751808293f5fc21c678c1
SHA512

89a8ff3f51fb9caa456e6c44f73bc13613791ed861e7e67a23deb5261772e772392267a4198a5d8e08384f49693e09872724f61714d9a9a031553ee66f39db12
SSDEEP

12288:McmF90zh+rsEhhFyq01u8YPT+ob1I0L/+zQwgdJ:McCQh+bhFy11RkN/+zQwU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6eb5f0355df4e21586f09843955bf9d_JaffaCakes118

Files

f6eb5f0355df4e21586f09843955bf9d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

246885d087e3eef0744095513e50adf7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAAsyncGetHostByName
WSAHtons
WSALookupServiceBeginA
gethostname
WSAEnumNetworkEvents
WSAConnect
getservbyname
accept

shell32

DragQueryPoint
SHGetSpecialFolderPathA

kernel32

ExitProcess
GetBinaryTypeA
WriteFile
GetProcessTimes
FormatMessageW
WriteConsoleOutputCharacterA
GlobalUnlock
GetDateFormatA
QueryDosDeviceA
GetCPInfo
_lread
ClearCommBreak
GetDiskFreeSpaceW
EraseTape
ReadFile
IsProcessorFeaturePresent
PulseEvent
LoadResource
_lclose
VirtualAlloc
lstrcmpiA
FreeEnvironmentStringsA
GetModuleFileNameW
GlobalFree
CreateMutexA
EnumTimeFormatsW
SwitchToFiber
FindFirstFileExW
SetEnvironmentVariableA
GlobalGetAtomNameW
TryEnterCriticalSection
_llseek
GetFileAttributesExA
CancelIo
GetLongPathNameA
GetDiskFreeSpaceExA
GetPrivateProfileStringW
SetConsoleMode
QueryDosDeviceW
CopyFileExW
WriteConsoleOutputW
GetUserDefaultLangID
SetSystemTime
SetConsoleActiveScreenBuffer
GetHandleInformation

user32

SetThreadDesktop
PostThreadMessageW
CountClipboardFormats
EnumDesktopsW
RegisterHotKey
CharLowerBuffW
GetSysColor
ChangeMenuA

advapi32

StartServiceCtrlDispatcherW
LookupPrivilegeNameA
ObjectCloseAuditAlarmW
RegCreateKeyW
InitiateSystemShutdownW

comctl32

DestroyPropertySheetPage
PropertySheetA
ImageList_LoadImageA
ImageList_Duplicate

msvcrt

_itow
strstr
_mbsnbcpy
__doserrno
_ecvt
isspace
_lseeki64
_chsize
rewind
_read
_mbslwr
ctime
getenv
wcsftime
_mbsnbcmp
_wstrdate
towlower
strftime
_wopen
wcscmp
_mbctolower
_wcsrev
_i64tow
floor
vsprintf
_mbctoupper
rand

Sections

.text
Size: 19KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

246885d087e3eef0744095513e50adf7

Headers

File Characteristics

Imports

ws2_32

shell32

kernel32

user32

advapi32

comctl32

msvcrt

Sections

.text Size: 19KB - Virtual size: 235KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 263KB - Virtual size: 263KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 19KB - Virtual size: 235KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 263KB - Virtual size: 263KB

.rsrc
Size: 16KB - Virtual size: 16KB