0785a976c5e83e5d7b467adec07b1f8e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0785a976c5e83e5d7b467adec07b1f8e_JaffaCakes118
Size

60KB
MD5

0785a976c5e83e5d7b467adec07b1f8e
SHA1

e5f946c0e90acb9e76d5f6798f3a930297881612
SHA256

4099aa3c3e0528086763782eb25274ddee0da2d7492fb6ae102df7a604127010
SHA512

2d5f4c9bf75e9ad7a3a538ac172699953ba5ff6376c01929f9f88e4f6d46739327e9de4fc3eaf02ac691750d120d05fbf44506f618bb0cc3b37946386bf29baa
SSDEEP

768:F8DYoLbZpoLPC0r2yDllKibzX8um22ffel6ohyQg7i9LkfJ+BcDtlD6R3lg4bs6N:QboPnr5DllXbzsp2l6r77iefRTDKBj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0785a976c5e83e5d7b467adec07b1f8e_JaffaCakes118

Files

0785a976c5e83e5d7b467adec07b1f8e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

19723469c921fd7ff96c28248d82af32

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Src\AntiVir\avguard-oem\avesvc\avesvc_main\Release\avesvc_main.pdb

Imports

kernel32

SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
SystemTimeToFileTime
GetLocalTime
LeaveCriticalSection
CloseHandle
UnmapViewOfFile
MapViewOfFile
WaitForSingleObject
OpenEventW
EnterCriticalSection
SetProcessWorkingSetSize
OpenProcess
lstrlenW
GetCurrentProcessId
GetCurrentProcess
GetModuleHandleW
CreateFileMappingW
DeviceIoControl
LoadLibraryA
GetTickCount
CreateFileA
GetLastError
GetModuleFileNameW
lstrcpynW
LoadLibraryW
GetProcAddress
FreeLibrary
GetStartupInfoA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetVersionExW
GetModuleHandleA
ExitProcess

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus

msvcr71

_snwprintf
_except_handler3
wcsncpy
vswprintf
wcschr
free
malloc
swprintf
calloc
realloc
_read
_lseek
_filelength
_close
_wsopen
_errno
_waccess
strtoul
__security_error_handler
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
wcsrchr
wcscat

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.crdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

19723469c921fd7ff96c28248d82af32

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

msvcr71

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 2KB

.crdata Size: 20KB - Virtual size: 20KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 2KB

.crdata
Size: 20KB - Virtual size: 20KB