32930c828cc9c27b90aa58c61d436198_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

32930c828cc9c27b90aa58c61d436198_JaffaCakes118
Size

97KB
MD5

32930c828cc9c27b90aa58c61d436198
SHA1

0218000f5cf347fa87bd8470c6ce3fcdfc4956db
SHA256

56366da342eb5fb07b785a885a653e5e65471a633bb73c16f9c411d2f162dd4e
SHA512

2ac19cd9cac522a13f34dd167191e0a328231abe5411b5cfe497f98de3fbd80a9dd905584754bb6292d36c80951280728a7758fd1e5b8a75a16f7abb024636c2
SSDEEP

1536:WIJhXG6L3ECRb3Mu3SsUaqTmTEANL7kVmIOdnToIfapMt6mI:WIJM6wCRbykTEgVTBfapMt6D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32930c828cc9c27b90aa58c61d436198_JaffaCakes118

Files

32930c828cc9c27b90aa58c61d436198_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b85e02c79f3686e75286c1296d3b6f67

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\xiaobai.new\client\branch\release_3.0.0.0\gui\bin\setup\xiaobaisetup\Installer.pdb

Imports

user32

MessageBoxW

shlwapi

StrStrIW

shell32

SHCreateDirectoryExW
ShellExecuteW

kernel32

SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
SetLastError
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
RtlUnwind
InitializeCriticalSection
LoadLibraryA
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
FindResourceW
LoadResource
GetCommandLineW
LockResource
SizeofResource
GetFileSize
ReadFile
GetModuleFileNameW
GetTickCount
CreateFileW
SetFilePointer
FreeResource
CloseHandle
WriteFile
GetLastError
GetCurrentProcessId
TerminateProcess
GetProcAddress
GetTempPathW
FindFirstFileW
WideCharToMultiByte
HeapAlloc
GetCurrentThreadId
Sleep
GetCurrentProcess
HeapFree
FindClose
OutputDebugStringW
GetProcessHeap
MultiByteToWideChar
GetVersionExA
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b85e02c79f3686e75286c1296d3b6f67

Headers

File Characteristics

PDB Paths

Imports

user32

shlwapi

shell32

kernel32

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 20KB - Virtual size: 16KB