2ef37d9f71e491d6e722810e46926155_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ef37d9f71e491d6e722810e46926155_JaffaCakes118
Size

12KB
MD5

2ef37d9f71e491d6e722810e46926155
SHA1

dd2f8dd426c2c1b8c8836c1645f8a358a7a88070
SHA256

6fb7669d51da91198447b5a11dc7824df5ed0b97fdf7d6f155d726a08a25cc29
SHA512

e99afcd62361934dc91955d45d53442edb9ca8d6298ac31089765d01e187b2ed2f6cd700c663b36d8070f0d885e085d85733cd942950f5a71385ba40b14c649a
SSDEEP

192:snHk/ihp8Q6iw4HGkgKLFlufDewVUcXd3fps5RvLCV40oyBLbA:sHVp8QqwfgKLFlcSktJRQRvLW1oyBL0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ef37d9f71e491d6e722810e46926155_JaffaCakes118

Files

2ef37d9f71e491d6e722810e46926155_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\我的DBank\phoenix\phoenix_ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE