General

Malware Config

Signatures

Files

• 28b8413419b5656cecb272e07079b047_JaffaCakes118

  .exe windows:6 windows x64 arch:x64

  219bad55dea5b14593a607fbdc160616

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  GetFocus

  MessageBoxA

  shell32

  SHGetSpecialFolderPathW

  CommandLineToArgvW

  kernel32

  HeapAlloc

  GetStartupInfoW

  IsDebuggerPresent

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCommandLineW

  lstrlenA

  LocalFree

  FormatMessageA

  SizeofResource

  GetModuleFileNameW

  FindResourceA

  GetLastError

  LoadLibraryA

  LockResource

  LoadResource

  FreeLibrary

  LoadLibraryExW

  VirtualProtect

  HeapFree

  SetLastError

  VirtualFree

  VirtualAlloc

  GetNativeSystemInfo

  QueryPerformanceCounter

  GetProcAddress

  GetProcessHeap

  IsBadReadPtr

  GetModuleHandleExW

  GetModuleHandleA

  SetDllDirectoryA

  SetDllDirectoryW

  OutputDebugStringA

  GetModuleHandleW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  GetCurrentProcessId

  vcruntime140

  wcsrchr

  __C_specific_handler

  __current_exception

  __current_exception_context

  memset

  memcpy

  api-ms-win-crt-string-l1-1-0

  strncpy

  _stricmp

  _strdup

  wcsncmp

  api-ms-win-crt-stdio-l1-1-0

  __acrt_iob_func

  _setmode

  __p__commode

  _set_fmode

  _fileno

  __stdio_common_vswprintf

  setvbuf

  __stdio_common_vsprintf

  api-ms-win-crt-convert-l1-1-0

  atoi

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  free

  realloc

  malloc

  api-ms-win-crt-utility-l1-1-0

  qsort

  bsearch

  api-ms-win-crt-runtime-l1-1-0

  terminate

  _register_onexit_function

  _initialize_onexit_table

  _seh_filter_exe

  _set_app_type

  _configure_narrow_argv

  _initialize_narrow_environment

  _get_narrow_winmain_command_line

  _initterm

  exit

  _exit

  _crt_atexit

  _cexit

  _c_exit

  _register_thread_local_exe_atexit_callback

  _initterm_e

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Exports

  Exports

  PyArg_ParseTuple

  PyBool_FromLong

  PyBytes_AsString

  PyCFunction_NewEx

  PyErr_Clear

  PyErr_Occurred

  PyErr_Print

  PyErr_SetImportError

  PyErr_SetObject

  PyErr_SetString

  PyEval_EvalCode

  PyExc_ImportError

  PyExc_RuntimeError

  PyExc_SystemError

  PyGILState_Ensure

  PyGILState_Release

  PyImport_AddModule

  PyImport_AppendInittab

  PyImport_GetModuleDict

  PyImport_ImportModule

  PyImport_ReloadModule

  PyLong_FromLong

  PyLong_FromVoidPtr

  PyModuleDef_Init

  PyModule_Create2

  PyModule_FromDefAndSpec2

  PyModule_GetDef

  PyModule_GetDict

  PyModule_New

  PyObject_CallObject

  PyObject_SetAttrString

  PyRun_InteractiveLoopFlags

  PyRun_SimpleStringFlags

  PySequence_GetItem

  PySequence_Size

  PySys_SetArgvEx

  PySys_SetObject

  PyTuple_New

  PyTuple_SetItem

  PyType_IsSubtype

  PyUnicode_FromFormat

  PyUnicode_FromString

  PyUnicode_FromWideChar

  Py_FdIsInteractive

  Py_Finalize

  Py_GetPath

  Py_Initialize

  Py_IsInitialized

  Py_SetPath

  Py_SetProgramName

  _PyImport_FindExtensionObject

  _PyImport_FixupExtensionObject

  Sections

  .text

  Size: 27KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 80B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ