3bff5034efcbb9801d40da47a006159f_JaffaCakes118

General

Target

3bff5034efcbb9801d40da47a006159f_JaffaCakes118
Size

56KB
MD5

3bff5034efcbb9801d40da47a006159f
SHA1

f666ef6003c0c2f4b2191c4c2e434b3afb1a6a43
SHA256

69ee86a9e00c2d35c342512722dd1efa094463f51302740af475b188cdb616d8
SHA512

f70e6122e5410eb02166816edeb399dc110fc9876d16aa4b4dbaffbc603589607acba8598c377d5eed9270013754c756d4141707f14097714a10d61b70808455
SSDEEP

768:rTVH4Y5OleUf1bBHaZYWTLR7U/P9VNXOiLfDv/I9NqgJzeqG:rxYkOj6LR7U/Pv/oh6qG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bff5034efcbb9801d40da47a006159f_JaffaCakes118

Files

3bff5034efcbb9801d40da47a006159f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b670f2cd492376edc352dae2b6066846

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\odin\miniloader\build\release\obj\src\main\miniloader-patchdate-stub.pdb

Imports

kernel32

ExitProcess
SetEvent
OpenEventW
SetCurrentDirectoryW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FindFirstFileW
FindClose
GetLocalTime
CreateThread
DeviceIoControl
SetErrorMode
GetVolumeInformationW
GetDiskFreeSpaceW
GetCommandLineW
GetDriveTypeW
SetVolumeLabelW
GetEnvironmentVariableW
Sleep
CloseHandle
SetStdHandle
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetFilePointer
GetLastError
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
lstrcpyA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetVersion
GetCommandLineA
RtlUnwind
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
GetCurrentProcess
TerminateProcess
HeapFree
HeapAlloc
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange

msvcrt

free
_initterm
_amsg_exit
_adjust_fdiv
_except_handler4_common
_XcptFilter
malloc

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b670f2cd492376edc352dae2b6066846

Headers

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

Sections

.text Size: 28KB - Virtual size: 24KB

.data Size: 16KB - Virtual size: 16KB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 28KB - Virtual size: 24KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 8KB - Virtual size: 6KB