ea57fb93fba2a9e38b7445dc092336e3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ea57fb93fba2a9e38b7445dc092336e3_JaffaCakes118
Size

51KB
MD5

ea57fb93fba2a9e38b7445dc092336e3
SHA1

2a1d37852e007e2b535318d73b0d4499590f1283
SHA256

d60f2832ca30e56aee90a332d88538937187e015c0c6aa7fddc8e7fc8dc015f7
SHA512

e9f22a752371b1197b7855121c91a8c1a799596488f1f6c247f1241b619f90a05756757a0a6763f8d0a7faa8b67a30bd91cfc203025ad384863c24fefedd1c36
SSDEEP

768:SxSTpvyeOed3vovUo/GIJLFv4PeV6vISvz+6rdgRp5b:SMTLvA8o/GIJxgPVHk5b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea57fb93fba2a9e38b7445dc092336e3_JaffaCakes118

Files

ea57fb93fba2a9e38b7445dc092336e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c4fd74dcb4e602337f5d2e6cc824ffc3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Users\Administrator\Desktop\Kill_KIS8\Kill_KIS8\Release\Kill_KIS8.pdb

Imports

kernel32

GetProcessHeap
OpenProcess
lstrcpynW
GetLastError
GetProcAddress
Process32FirstW
GetModuleHandleW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
DuplicateHandle
CloseHandle
GetCurrentProcessId
HeapFree
GetCurrentProcess
CreateEventW
HeapAlloc
CreateFileA
SetStdHandle
WriteConsoleW
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
HeapSize
WriteConsoleA
GetConsoleOutputCP

advapi32

GetTokenInformation
OpenProcessToken
LookupAccountSidW

ntdll

NtQueryObject
RtlEqualUnicodeString
RtlInitUnicodeString
NtQuerySystemInformation
RtlUnwind

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4fd74dcb4e602337f5d2e6cc824ffc3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ntdll

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 436B