0b2abea30cd14ff31e7e2c0794a7a2c8_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0b2abea30cd14ff31e7e2c0794a7a2c8_JaffaCakes118
Size

20KB
MD5

0b2abea30cd14ff31e7e2c0794a7a2c8
SHA1

890497f0948e6d7765b69f453fcaee852c904697
SHA256

c5b8c251a13431d15077abd7715b27834c33c4a218262994a3b30b17f922b705
SHA512

483ac16482b30f0b8675b5e130b5c42db52d1cfbfafe8192fa0ff6975c9b891b2a170e225faeecee19c2315bfaba7dfefe924595ea8a3b0957191d811a8d787c
SSDEEP

384:fWFlmhTBbcmOY9WvWFksuqTY2czuGnuGvHHC+CZftS:Ilmhu1Y9APsrU2cyGuGfHCTft

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b2abea30cd14ff31e7e2c0794a7a2c8_JaffaCakes118

Files

0b2abea30cd14ff31e7e2c0794a7a2c8_JaffaCakes118
.exe windows:1 windows x86 arch:x86

cf921f0db88fa93d18973ae4b7df0c76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSACleanup
WSAStartup
accept
bind
closesocket
htonl
htons
listen
recv
select
send
socket

urlmon

URLDownloadToFileA

kernel32

ExitThread
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetVersionExA
LoadLibraryA
OpenProcess
PeekNamedPipe
ReadFile
RtlUnwind
Sleep
TerminateProcess
TerminateThread
WaitForMultipleObjects
CreatePipe
WinExec
CreateProcessA
WriteFile
lstrlenA
CreateThread
DisconnectNamedPipe
DuplicateHandle

user32

ExitWindowsEx

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
CloseServiceHandle
CreateServiceA
DeleteService

crtdll

__GetMainArgs
_strnicmp
atoi
exit
free
malloc
memcpy
memset
raise
signal
strcat
strchr
strcmp
strpbrk
strstr
strtok

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cf921f0db88fa93d18973ae4b7df0c76

Headers

File Characteristics

Imports

wsock32

urlmon

kernel32

user32

advapi32

crtdll

Sections

.text Size: 6KB - Virtual size: 6KB

.bss Size: - Virtual size: 4KB

.data Size: 1KB - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 6KB - Virtual size: 6KB

.bss
Size: - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 8KB - Virtual size: 8KB