11f9957a16bd901b2485fa3a04a00512_JaffaCakes118

General

Target

11f9957a16bd901b2485fa3a04a00512_JaffaCakes118
Size

13KB
MD5

11f9957a16bd901b2485fa3a04a00512
SHA1

55a2f3b6633856ab352fc5e7253f761eb8ee7f8a
SHA256

9123467a84c5ebf10a86cf6321f57c5157a5a381a083075454a5d2801444c059
SHA512

eccd0763faeadb8f6621db24ec16fc65662530fea2b1b48f81f5c371309c63f3741d4815b49454cefa068b89b4dc4fdbaf900dabd5de1ed34967674b487e4c6c
SSDEEP

192:KInkY2+8UpwPiaqejtmp5a6Wl1cvLz2tmj0awd5qEvQI:KIkYL8SwqaqejtmKXcn2t3pqEII

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11f9957a16bd901b2485fa3a04a00512_JaffaCakes118

Files

11f9957a16bd901b2485fa3a04a00512_JaffaCakes118
.exe .vbs windows:4 windows x86 arch:x86 polyglot

9547327f9c4fdf1269ad457ef2804eae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetTimer
wsprintfA
GetMessageA

kernel32

FreeLibrary
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetFileAttributesA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetTickCount
GetVersion
HeapAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
ExitProcess
OpenThread
Process32First
Process32Next
ReadProcessMemory
RtlZeroMemory
SetUnhandledExceptionFilter
Sleep
TerminateThread
VirtualAlloc
VirtualFree
VirtualQueryEx
WaitForSingleObject
_lclose
_lcreat
_lwrite
lstrcatA
lstrcpyA
lstrlenA
EnterCriticalSection
DeleteCriticalSection
CreateToolhelp32Snapshot
CreateThread
CreateMutexA
CreateDirectoryA
CopyFileA
CloseHandle
OpenProcess

shell32

ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListA

ws2_32

closesocket
gethostbyname
WSAStartup
WSAIoctl
socket
send
recv
inet_ntoa
htons
bind
gethostname

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyA
AllocateAndInitializeSid
EqualSid
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
AdjustTokenPrivileges

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9547327f9c4fdf1269ad457ef2804eae

Headers

File Characteristics

Imports

user32

kernel32

shell32

ws2_32

advapi32

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 21KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 21KB