493b6abddd628ebdf45d7b6f1524c0a5_JaffaCakes118

General

Target

493b6abddd628ebdf45d7b6f1524c0a5_JaffaCakes118
Size

31KB
MD5

493b6abddd628ebdf45d7b6f1524c0a5
SHA1

aeb470c739f12b5bf6ae54a91841157dcb354eb0
SHA256

7056c1f58eace0959f498ef740483810ea22d7ee1a2b7f3b24d33015c68b8edb
SHA512

fe34a5287b58a348c84e51460de2789e31904e8f52c18acdbbc7909ead626bc7bf85188daac42baf846008a99d7798cf5b93d5f8ce042db102db117bd90a4ffa
SSDEEP

384:7jwXr2PDfkdc+1/t3r2cUgZWfZtUV7LCwfvhQ4XQWqk51M3BDGXk07u3M1ob+1xC:gteiUgZWfZkLdP1k6Xk8cMSmQiM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
493b6abddd628ebdf45d7b6f1524c0a5_JaffaCakes118

Files

493b6abddd628ebdf45d7b6f1524c0a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0bbd3443a045e969cdd37a3f59a051c9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Projects\VS2005\WirelessKeyDump\Release\WirelessKeyDump.pdb

Imports

msvcrt

_c_exit
_exit
_except_handler3
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
??1type_info@@UAE@XZ
__set_app_type
?terminate@@YAXXZ
_controlfp
printf
_mbsicmp
strcat
_strcmpi
strchr
strncmp
__p__fmode
strcpy
sprintf
??3@YAXPAX@Z
strlen
malloc
strtoul
strcmp
free
_memicmp
atoi
??2@YAPAXI@Z
strrchr
memset
wcslen
memcpy
_snprintf
memcmp

kernel32

GetSystemDirectoryA
VirtualFreeEx
VirtualAllocEx
WaitForSingleObject
ResumeThread
WriteProcessMemory
ReadProcessMemory
CreateRemoteThread
OpenProcess
GetCurrentProcess
SetErrorMode
GetStdHandle
WideCharToMultiByte
LockResource
ReadFile
GetProcAddress
FreeLibrary
LoadLibraryA
LocalFree
GetLastError
LocalAlloc
GetFileSize
CloseHandle
LoadResource
MultiByteToWideChar
FindNextFileA
GetModuleHandleA
FindFirstFileA
CreateFileA
GetFileAttributesA
FindResourceA
GetVersionExA
FindClose
GetWindowsDirectoryA

advapi32

CryptGetHashParam
CryptAcquireContextA
RegEnumValueA
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
CryptDestroyHash
CryptDeriveKey
CryptDecrypt
CryptReleaseContext
CryptCreateHash
CryptHashData

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bbd3443a045e969cdd37a3f59a051c9

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 560B

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 560B