231908a0eec51fd1ab0a443f14820ced_JaffaCakes118

General

Target

231908a0eec51fd1ab0a443f14820ced_JaffaCakes118
Size

23KB
MD5

231908a0eec51fd1ab0a443f14820ced
SHA1

a1541f59378886cf82a7aa629ed764d46cafb3bf
SHA256

0503b7263398812ab719b7adc381eaa45756ca57167864a77460c754e26d9ecc
SHA512

b54adbf8c630b5dd81d31a91e784f7cbbb0e93da2b73dad41d50f9a2d0d87b6bbcfd2c7d1ce1f187e26de32d849f5f5ef5089c83cf1276c30c9489da4b8868a8
SSDEEP

384:ycW8zT/C9tAEeKyXqVRzBFFFCmpRFEA9KBx0aSGPZJX6gyHF8FFFKSIrd9Vb0nlk:gCmWfeRCmJEA9KBx0aSGX6gyBd9Vbvbl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
231908a0eec51fd1ab0a443f14820ced_JaffaCakes118

Files

231908a0eec51fd1ab0a443f14820ced_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7a3743b1f20447304b1666f1dc4f3c35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\0bulknet\build_root\pre-loader.35\startdrv\objfre_wxp_x86\i386\StartDrv.pdb

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyW
RegOpenKeyA
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerA

kernel32

GetProcAddress
GetModuleHandleW
lstrcatW
lstrlenW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceW
CloseHandle
WriteFile
CreateFileW
ExitProcess
GetEnvironmentVariableW
lstrcpyW
GetShortPathNameW
GetModuleFileNameW
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
GetTickCount
ResumeThread
SetThreadContext
VirtualProtectEx
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
CreateProcessW
DeleteFileW
DeviceIoControl
CreateFileA
GetVersionExW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

shell32

ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a3743b1f20447304b1666f1dc4f3c35

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

shell32

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 32B

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 32B

.rsrc
Size: 17KB - Virtual size: 16KB