4dd238cc64d82707a52b184913c3ba6b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4dd238cc64d82707a52b184913c3ba6b_JaffaCakes118
Size

153KB
MD5

4dd238cc64d82707a52b184913c3ba6b
SHA1

033bc45d0ebb8b8a340e0057abc81d6af07c6b35
SHA256

400c3b3317bf4f107e7634597c7cc065acaee9c2af8528af8583ce326fc9b62e
SHA512

232d58b6a8efdc6b6f96e3583870bc280cf29005545514d67511516cedc2e981b3f8c5237c06dee8b09e3d39e009de7ade7665b87d621070e793513bbeb72fbf
SSDEEP

3072:4q4PXqP1dCf/tGKOmsLBuNnMNLnaxpsMw:vEYIAKOmKBuNM18aMw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dd238cc64d82707a52b184913c3ba6b_JaffaCakes118

Files

4dd238cc64d82707a52b184913c3ba6b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7eab902e66cd68b9c246b9343ce27479

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\_Program\发布配置区\exe文件运行绑定器\exe分发运行机母鸡.pdb

Imports

kernel32

TerminateProcess
FileTimeToSystemTime
GetLastError
SetLastError
LocalFree
FreeLibrary
lstrlenW
GetProcAddress
LoadLibraryA
GetCurrentProcessId
ExitProcess
GetModuleHandleA
GetTempPathA
GetFileAttributesA
SetFileAttributesA
SetPriorityClass
HeapAlloc
HeapFree
GetTickCount
GetCurrentThread
GetProcessHeap
GetCommandLineA
SetProcessPriorityBoost
lstrcatA
GetEnvironmentVariableA
SetThreadPriority
GetShortPathNameA
GetModuleFileNameA
GetVersionExA
lstrcpyA
FindResourceA
FreeResource
LoadResource
LockResource
LoadLibraryExA
FindFirstFileA
FindClose
FindNextFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapSize
RtlUnwind
InitializeCriticalSection
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
GetCurrentProcess
Sleep
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
MultiByteToWideChar
GetSystemDirectoryA
InterlockedDecrement
WideCharToMultiByte
SizeofResource
GetStdHandle
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapReAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

GetClassNameA
GetParent
GetWindowTextA
GetDesktopWindow
EnumChildWindows

shell32

SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListA
ShellExecuteExA

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleRun

oleaut32

VariantInit
VariantClear
SysFreeString

oleacc

WindowFromAccessibleObject
AccessibleObjectFromWindow
GetRoleTextA

Sections

.text
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 596KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eab902e66cd68b9c246b9343ce27479

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

oleaut32

oleacc

Sections

.text Size: 64KB - Virtual size: 61KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 39KB

.rsrc Size: 596KB - Virtual size: 594KB

.text
Size: 64KB - Virtual size: 61KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 39KB

.rsrc
Size: 596KB - Virtual size: 594KB