fa89ee73a273790cbed3f32e78d2489f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fa89ee73a273790cbed3f32e78d2489f_JaffaCakes118
Size

3.6MB
MD5

fa89ee73a273790cbed3f32e78d2489f
SHA1

107844339afd6e36c1b36ee9a72e033ab1e6df68
SHA256

96df786843babd56f41233095be063d4df800ce3036a0b6bb83557bf78cfe35c
SHA512

2dc42d8f93f22c481541fb26abefb8db6cd234cd5d9bd28e245f28af5601e9c362c8d1dcd49070cf0e040a01ea090c1e0923f01fcd451cb96d649490e1509964
SSDEEP

49152:d8AS8MMYgKkBTqMuAeiCl/NgVpt9spXOglHXE1Hn/8/UgoAmsPwbhjdm08LhJ6wX:phBKIvRs/Ep8OglyCUqfobhN8awlU4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa89ee73a273790cbed3f32e78d2489f_JaffaCakes118

Files

fa89ee73a273790cbed3f32e78d2489f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a538f0f6e75400466a7bacb741be2e15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges

iphlpapi

ConvertInterfaceIndexToLuid

kernel32

AddVectoredExceptionHandler
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

__argv

psapi

GetProcessMemoryInfo

user32

DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

userenv

GetUserProfileDirectoryW

ws2_32

FreeAddrInfoW

wtsapi32

WTSSendMessageW

Exports

Exports

MHD_add_connection
MHD_add_response_footer
MHD_add_response_header
MHD_create_response_for_upgrade
MHD_create_response_from_buffer
MHD_create_response_from_callback
MHD_create_response_from_data
MHD_create_response_from_fd
MHD_create_response_from_fd64
MHD_create_response_from_fd_at_offset
MHD_create_response_from_fd_at_offset64
MHD_del_response_header
MHD_destroy_response
MHD_free
MHD_get_connection_info
MHD_get_connection_values
MHD_get_daemon_info
MHD_get_fdset
MHD_get_fdset2
MHD_get_reason_phrase_for
MHD_get_response_header
MHD_get_response_headers
MHD_get_timeout
MHD_get_version
MHD_http_unescape
MHD_is_feature_supported
MHD_lookup_connection_value
MHD_queue_response
MHD_quiesce_daemon
MHD_resume_connection
MHD_run
MHD_run_from_select
MHD_set_connection_option
MHD_set_connection_value
MHD_set_panic_func
MHD_set_response_options
MHD_start_daemon
MHD_start_daemon_va
MHD_stop_daemon
MHD_suspend_connection
MHD_upgrade_action

Sections

.text
Size: - Virtual size: 754KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dfgjh0
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dfgjh1
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a538f0f6e75400466a7bacb741be2e15

Headers

File Characteristics

Imports

advapi32

iphlpapi

kernel32

msvcrt

psapi

user32

userenv

ws2_32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 754KB

.data Size: - Virtual size: 372B

.rdata Size: - Virtual size: 73KB

.eh_fram Size: - Virtual size: 117KB

.bss Size: - Virtual size: 5KB

.edata Size: - Virtual size: 1KB

.idata Size: - Virtual size: 9KB

.CRT Size: - Virtual size: 56B

.tls Size: - Virtual size: 32B

.dfgjh0 Size: - Virtual size: 2.2MB

.dfgjh1 Size: 3.6MB - Virtual size: 3.6MB

.reloc Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: - Virtual size: 754KB

.data
Size: - Virtual size: 372B

.rdata
Size: - Virtual size: 73KB

.eh_fram
Size: - Virtual size: 117KB

.bss
Size: - Virtual size: 5KB

.edata
Size: - Virtual size: 1KB

.idata
Size: - Virtual size: 9KB

.CRT
Size: - Virtual size: 56B

.tls
Size: - Virtual size: 32B

.dfgjh0
Size: - Virtual size: 2.2MB

.dfgjh1
Size: 3.6MB - Virtual size: 3.6MB

.reloc
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB