2cb3965db7f10113bf252bac96e8af70_JaffaCakes118

General

Target

2cb3965db7f10113bf252bac96e8af70_JaffaCakes118
Size

92KB
MD5

2cb3965db7f10113bf252bac96e8af70
SHA1

d5c08055c94ceb95d4a217b2ba0b2eff045dacd2
SHA256

8812e20a0566e87bb9328c41c43a35d936c585a0624800267a64c6ecef868182
SHA512

d3152e5fa926fd22d2ef34ac389802e9d602aa779171700548a12dc2a1aaa83a1981b9971c3f5579dbfcc8318272ec64da42453c9330a3fc492ece88ddffbb4c
SSDEEP

768:652IOO5TpdKnE0k+O2IOOU+V+TQOPiKKX:6520PdKrkP20UgKVKX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cb3965db7f10113bf252bac96e8af70_JaffaCakes118

Files

2cb3965db7f10113bf252bac96e8af70_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6fc9bce9e3b43f963ad85318bd03945

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

klipopga.pdb

Imports

upnphost

ServiceMain
DllCanUnloadNow

dbnmpntw

ConnectionWrite
ConnectionRead

ctl3d32

Ctl3dUnregister
Ctl3dCtlColor

cryptdll

CDLocateRng
MD5Init
MD5Update
CDBuildVect

kernel32

GetDiskFreeSpaceA
SleepEx
CompareStringW
VirtualQuery
LoadLibraryA
GetCurrentProcess
QueryDosDeviceA
CreateDirectoryA
GetConsoleAliasW
WriteProcessMemory
GetDateFormatW
GetPrivateProfileIntA
GetNumberFormatA
WriteFile
ExpandEnvironmentStringsA
SetEnvironmentVariableA
CreateMutexA
GetTickCount
HeapCreate
GetAtomNameA

shlwapi

UrlCombineA
UrlIsA
UrlCompareA
UrlUnescapeA
UrlIsNoHistoryA
UrlGetLocationA
UrlCanonicalizeA
UrlCreateFromPathA
PathCommonPrefixA
UrlGetPartA
UrlHashA

user32

IsCharLowerA
ShowWindow
LoadCursorA
GetCaretPos
IsWindow
DialogBoxParamW
CharToOemA
GetMessageA
SetFocus
IsDialogMessageA
GetWindowLongA
SetCursorPos
DispatchMessageA
LoadImageW
PeekMessageA
PostMessageA
DrawIcon
wsprintfA

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6fc9bce9e3b43f963ad85318bd03945

Headers

File Characteristics

PDB Paths

Imports

upnphost

dbnmpntw

ctl3d32

cryptdll

kernel32

shlwapi

user32

Sections

.text Size: 52KB - Virtual size: 48KB

.data Size: 20KB - Virtual size: 16KB

.rsrc Size: 16KB - Virtual size: 12KB

.text
Size: 52KB - Virtual size: 48KB

.data
Size: 20KB - Virtual size: 16KB

.rsrc
Size: 16KB - Virtual size: 12KB