3f5582621556addfe5b285e0c60805ab_JaffaCakes118

General

Target

3f5582621556addfe5b285e0c60805ab_JaffaCakes118
Size

324KB
MD5

3f5582621556addfe5b285e0c60805ab
SHA1

28e9c3a924f91cc31164f6ff4c5b5e54c3595a33
SHA256

2597caae3c119a144eb3a148dd08339a533cf2f82607b1f42e14ce66c3807977
SHA512

98db5239abc8b40490357309e6824eb8db231935499697d9bbcfd85f0dcd84bf1296afa7cc2b35d5fafc005390a1dc40a55c8149829b52d05f337a69af996eba
SSDEEP

6144:07PvEnE36vSySgZb0sPmCmHhEY/5BUpFiSumPyfQnxN:+ELaynPlCEsUpnmIxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f5582621556addfe5b285e0c60805ab_JaffaCakes118

Files

3f5582621556addfe5b285e0c60805ab_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b1f13925dcc8a50ee7d3da9907f33f76

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

k:\FileBase\Yilin\works\RP\SecurityPrograms\Projects\Emails\EmailBotAxp\Final\Bot\Release\WmUpdate.pdb

Imports

kernel32

Sleep
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetLastError
CompareStringW
CompareStringA
FlushFileBuffers
CloseHandle
CreateFileA
ReadFile
GetModuleHandleA
ExitProcess
RtlUnwind
RaiseException
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
HeapSize
MultiByteToWideChar
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

DefWindowProcA
CreateWindowExA
LoadCursorA
RegisterClassExA
PostQuitMessage

Sections

.text
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b1f13925dcc8a50ee7d3da9907f33f76

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 248KB - Virtual size: 247KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 12KB - Virtual size: 19KB

.text
Size: 248KB - Virtual size: 247KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 12KB - Virtual size: 19KB