3bcd4385cbe1e9dbc5f4c76c398e2752_JaffaCakes118

General

Target

3bcd4385cbe1e9dbc5f4c76c398e2752_JaffaCakes118
Size

343KB
MD5

3bcd4385cbe1e9dbc5f4c76c398e2752
SHA1

8d61d7d70180bdc38b5f17fa2490024e6d33ed43
SHA256

c157afcd52c2258576a0e2cc253c617432a4aaf86b66096781531c213a9b6e9f
SHA512

a23ea7ffe018173fa035d066727dd153ecd515300d30157a0ce226dc0b727643af2bf9f29bce2519b682d2afbe1628a73b7151c0d04ef89e54ccce6f3b209461
SSDEEP

6144:tFB4N5Q0X4H13yNBnchL3N4XCmwukaUISps3:3B4N5eH4ncRNysps

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bcd4385cbe1e9dbc5f4c76c398e2752_JaffaCakes118

Files

3bcd4385cbe1e9dbc5f4c76c398e2752_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0b14620c752db99e472b6a7fa9e8bda3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

cygwin1

__errno
__main
_ctype_
_exit
_fcntl64
_geteuid32
_getuid32
_open64
_stat64
abort
accept
atoi
atol
bind
calloc
close
connect
ctime
cygwin_internal
dll_crt0__FP11per_process
execl
exit
fork
free
gethostbyname
getpid
getppid
getsockname
inet_addr
inet_ntoa
listen
localtime
malloc
memcpy
memset
printf
pthread_atfork
puts
rand
read
realloc
recvfrom
select
sendto
setsid
setsockopt
signal
socket
sprintf
srand
sscanf
strchr
strcmp
strcpy
strlen
strncpy
strpbrk
strstr
time
unlink
usleep
vsprintf
waitpid
write

kernel32

AddAtomA
FindAtomA
GetAtomNameA
GetModuleHandleA

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stab
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stabstr
Size: 42KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b14620c752db99e472b6a7fa9e8bda3

Headers

File Characteristics

Imports

cygwin1

kernel32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 5KB - Virtual size: 5KB

.bss Size: - Virtual size: 14KB

.idata Size: 2KB - Virtual size: 1KB

.stab Size: 162KB - Virtual size: 161KB

.stabstr Size: 42KB - Virtual size: 45KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 5KB - Virtual size: 5KB

.bss
Size: - Virtual size: 14KB

.idata
Size: 2KB - Virtual size: 1KB

.stab
Size: 162KB - Virtual size: 161KB

.stabstr
Size: 42KB - Virtual size: 45KB