4a2be67808246e8e7626a8940daaf728_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4a2be67808246e8e7626a8940daaf728_JaffaCakes118
Size

12KB
MD5

4a2be67808246e8e7626a8940daaf728
SHA1

54f46afa3a0bb7b5cf6814a47c59a16c31051129
SHA256

622043d90f7792a67f059540e4b21d77c6e31faa6aa3e0bb253d9d86f2fee1dd
SHA512

5df373a5a07fc7981e6f41fd8491e9eb54752e75d2d078a9d2fb8e1bff652dac028269becf62979b13da9a2dca1fb3ea923ffd6a1ccdf034a178fd348b097569
SSDEEP

192:snHk/ihp8Q6iw4HGkgKLFlufDewVUcXd3fps5RvLCV40oyBLbS:sHVp8QqwfgKLFlcSktJRQRvLW1oyBLm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a2be67808246e8e7626a8940daaf728_JaffaCakes118

Files

4a2be67808246e8e7626a8940daaf728_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\我的DBank\phoenix\phoenix_ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE