f77e7bd43f365593014469cf644ced65_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f77e7bd43f365593014469cf644ced65_JaffaCakes118
Size

352KB
MD5

f77e7bd43f365593014469cf644ced65
SHA1

66692ff392d5844b8bc362cb8a2640927cea6fbf
SHA256

56a0cec492d2f8d68f8c9c5f54a9c9407f352e3b33e1e3e6c68409acb0ec04ac
SHA512

69b6a5fc7b42f714167b39a4b38ed98a95af44a41ba76129f0a43341c459d148d674751f839a8442a1073268e9de88deec9a2cd7bf9eadb46dd63a847a64a885
SSDEEP

6144:g87Sm49lFRQSAe5klIQm3n/ym1grjpY7nf9Bv3lYdkv+hgG2gnG4V/gU:Im+3QSAdm3n/yogZgbv3Gqv0gG2gG4lv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f77e7bd43f365593014469cf644ced65_JaffaCakes118

Files

f77e7bd43f365593014469cf644ced65_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Pieceespecially\watchPeriod\farmShine\Sing.pdb

Imports

kernel32

ExitProcess
GetFileAttributesA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
MultiByteToWideChar
GetShortPathNameA
CopyFileA
GetTempFileNameA
LoadLibraryA
WaitForMultipleObjects
GetModuleFileNameA
VirtualProtect
GetCurrentProcessId
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetCPInfo
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
HeapSize
GetUserDefaultLCID
SetEnvironmentVariableA

ws2_32

ioctlsocket
inet_ntoa
WSAStartup
recvfrom
ntohl
inet_addr
htons
WSACleanup
recv
socket
getservbyname
send
getsockopt
listen

Exports

Exports

DllRegisterServer
Exactnature
Happenthousand
Probablepath

Sections

.text
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0e710d4ed87ec11636d345dba071187

Headers

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 241KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 16KB - Virtual size: 385KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 244KB - Virtual size: 241KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 16KB - Virtual size: 385KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB