b49e692cfe8c29db8c09e16d25ca8e61_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b49e692cfe8c29db8c09e16d25ca8e61_JaffaCakes118
Size

16KB
MD5

b49e692cfe8c29db8c09e16d25ca8e61
SHA1

c4c66df23a787429b8f834fccb15c4bcda91ad49
SHA256

82a730582ef4d322803a7b7a3cbaa82599b528d3b38693cb9d66e3b3a79fff1a
SHA512

ca2ff042ee6ed836da6333128abc454eee8a64e45d3daad31d08d42451144203032336a22a3d470e6678f3af00a318c0b28b5a17dc10cc8b3311cf20fc992321
SSDEEP

384:FIECK53VT7wU774/a3C66KWfTNv4DlWv1yxiO4EyXr:Fg+H74/iC66KQNw8d6iOryb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b49e692cfe8c29db8c09e16d25ca8e61_JaffaCakes118

Files

b49e692cfe8c29db8c09e16d25ca8e61_JaffaCakes118
.exe windows:5 windows x64 arch:x64

2c4462921bdaf90d25ec83b01b4c1481

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\SimCity_VC10\cppunit\bin\x64\ReleaseUnicode\CppUnitRunner.exe.pdb

Imports

kernel32

CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
GetModuleHandleExW
OutputDebugStringA
LoadLibraryExA
FreeLibrary
LocalFree
FormatMessageW
SetErrorMode
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
SetUnhandledExceptionFilter
EncodePointer
Sleep
GetSystemTimeAsFileTime

cppunit_dll

?addTest@TestRunner@CppUnit@@UEAAXPEAVTest@2@@Z
?run@TextTestRunner@CppUnit@@QEAA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N11@Z
??1TextTestRunner@CppUnit@@UEAA@XZ
?getRegistry@TestFactoryRegistry@CppUnit@@SAAEAV12@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0TextTestRunner@CppUnit@@QEAA@PEAVOutputter@1@@Z

shlwapi

PathFindFileNameW

msvcp100

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

msvcr100

memmove
__C_specific_handler
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
?what@exception@std@@UEBAPEBDXZ
??3@YAXPEAX@Z
__CxxFrameHandler3
memcpy
__iob_func
_cwprintf_s
??2@YAPEAX_K@Z
_CxxThrowException
??0exception@std@@QEAA@AEBV01@@Z
memset
_amsg_exit
__getmainargs
_XcptFilter
_exit
_cexit
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_unlock
__dllonexit
_lock
_onexit
fflush

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c4462921bdaf90d25ec83b01b4c1481

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

cppunit_dll

shlwapi

msvcp100

msvcr100

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 256B

.pdata Size: 1024B - Virtual size: 648B

.rsrc Size: 512B - Virtual size: 436B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 256B

.pdata
Size: 1024B - Virtual size: 648B

.rsrc
Size: 512B - Virtual size: 436B