4ab524834cff7ffffe53662a019053e5_JaffaCakes118

General

Target

4ab524834cff7ffffe53662a019053e5_JaffaCakes118
Size

80KB
MD5

4ab524834cff7ffffe53662a019053e5
SHA1

dffaab74aef7b3d3c5c33e60f9ec2747ffdf777f
SHA256

e1f385589660d0ef5f235fd98c07a15b89ab3b7db0b4528225ee358adc61b273
SHA512

db2f0921d83d2a1f3c39eb87546fa884dc6705a895d39be45902d63ebebcf1b6a67e6467bc1d95085ab2e5a8d3d8d8fc7f72f6c593c2f6ac236a05113167688a
SSDEEP

1536:ZrQIj4/1mOTeSLRpKNYVA23Bb4cMYMVS+jkk+dy3gWoelYV:ZrQIjqRpKNYVA2d0WLdYgRelYV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ab524834cff7ffffe53662a019053e5_JaffaCakes118

Files

4ab524834cff7ffffe53662a019053e5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f5e27962a466d7098c90b3a165bfc768

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\driver\Ressdt\复件 exe\Debug\SSDTDump.pdb

Imports

shlwapi

PathFileExistsA

kernel32

GetProcAddress
GetModuleHandleA
lstrcpynA
GlobalAlloc
GetModuleFileNameA
CreateFileA
CloseHandle
LoadLibraryExA
GlobalFree
FreeLibrary
DeviceIoControl
GetLastError
GetLocaleInfoA
lstrcpyA
UnhandledExceptionFilter
GetCommandLineA
GetVersionExA
DebugBreak
RaiseException
LoadLibraryA
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
ExitProcess
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
HeapAlloc
GetProcessHeap
IsBadWritePtr
IsBadReadPtr
HeapValidate
SetConsoleCtrlHandler
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
VirtualAlloc
HeapReAlloc
VirtualQuery
InterlockedExchange
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

advapi32

DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
ControlService

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f5e27962a466d7098c90b3a165bfc768

Headers

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

advapi32

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 7KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 7KB