2a093bb0eeecf2755d81a9d46dfbef73_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2a093bb0eeecf2755d81a9d46dfbef73_JaffaCakes118
Size

117KB
MD5

2a093bb0eeecf2755d81a9d46dfbef73
SHA1

510bae53e1eff0cd7cd6c0a4f6f62946bdae0f2d
SHA256

a40e5b3e31aa19c7afd5cf0994344c67d7c2dd33faa18bd95fd30b16fc9ac42d
SHA512

6e501c4af4565b3246a5a2cf02ce4bf9cb3a549755f2e64bfe527748c66fba7a7a8390c872abc5d38b00d206e5a73f00c5c4b6e5330666530bf469d01b5c4c28
SSDEEP

1536:c7kXPsvK/2C7Xl62IcHYh2BX1xM+IqYPuk78lzg7GoMCtW6NfPG1c:6sPsv1eXA2NHPXM+y8dg7GoMCtW6w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a093bb0eeecf2755d81a9d46dfbef73_JaffaCakes118

Files

2a093bb0eeecf2755d81a9d46dfbef73_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6dcbe51c55a379146930434cd3dbbae7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
LoadLibraryA
SetErrorMode
DeleteFileA
TerminateProcess
OpenProcess
ExpandEnvironmentStringsA
UnmapViewOfFile
MapViewOfFile
GetTempPathA
GetVersionExA
GlobalMemoryStatus
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
CreateMutexA
GetLastError
ExitProcess
GetSystemDirectoryA
GetModuleFileNameA
CopyFileA
TerminateThread
CreateThread
Sleep
CreateFileA
ExitThread
GetTickCount
WriteFile
CloseHandle
CreateFileMappingA
CreateProcessA
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
SetFilePointer
SetEndOfFile
GetFileType
GetStdHandle
SetHandleCount
ReadFile
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
HeapAlloc
HeapFree

user32

GetWindowTextA
FindWindowA
SendMessageA
GetForegroundWindow
GetAsyncKeyState
GetKeyState

advapi32

StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA

shell32

ShellExecuteA

ws2_32

gethostbyname
WSAStartup
inet_addr
connect
socket
bind
listen
select
accept
send
inet_ntoa
recv
closesocket
WSACleanup
gethostbyaddr
ioctlsocket
WSAAsyncSelect
ntohs
WSAIoctl
gethostname
__WSAFDIsSet
getsockname
htons

wininet

InternetReadFile
FtpGetFileA
InternetConnectA
InternetOpenA
FtpPutFileA
InternetCloseHandle
InternetOpenUrlA

netapi32

NetShareDel

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6dcbe51c55a379146930434cd3dbbae7

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

wininet

netapi32

psapi

Sections

.text Size: 84KB - Virtual size: 84KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 20KB - Virtual size: 204KB

.aspack Size: 4KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

.text
Size: 84KB - Virtual size: 84KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 20KB - Virtual size: 204KB

.aspack
Size: 4KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB