4dc76818034b2aa5d2b504277a001707_JaffaCakes118

General

Target

4dc76818034b2aa5d2b504277a001707_JaffaCakes118
Size

23KB
MD5

4dc76818034b2aa5d2b504277a001707
SHA1

9fc016a4433d4c9dee3239f35f2f466d8444fd02
SHA256

f97bfc0a5bfa99f83360cddf00c0159ed3a7b10db13db4170c8495ad35069043
SHA512

29066e54a65e1320a2ef9c46761529e903493b38e9fdb8c9342ab26bd4963fe6a4fd01da96d1d1a4aa204b2f2719dab55edfb7ed3c3d1db3e9e42ea3787cb07a
SSDEEP

384:zn82zRWCnaa4KyXdVRNbFFFH6kRVNEA9KBx0aSGPYNX6gyHF8FFF/WkR7YXD2r8K:TBh4TRr6ONEA9KBx0aSGY6gysPUDAjsq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dc76818034b2aa5d2b504277a001707_JaffaCakes118

Files

4dc76818034b2aa5d2b504277a001707_JaffaCakes118
.exe windows:5 windows x86 arch:x86

96d00ede7a720bc70e3485a474efff8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\0bulknet\build_root\pre-loader.32\startdrv\objfre_wxp_x86\i386\StartDrv.pdb

Imports

advapi32

RegCloseKey
RegSetValueExA
RegSetValueExW
RegCreateKeyW
RegOpenKeyA
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerA

kernel32

GetProcAddress
GetModuleHandleW
lstrcatW
lstrlenW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
CloseHandle
WriteFile
CreateFileW
ExitProcess
GetEnvironmentVariableW
lstrcpyW
GetShortPathNameW
GetModuleFileNameW
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
GetTickCount
ResumeThread
SetThreadContext
VirtualProtectEx
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
GetThreadContext
CreateProcessW
DeleteFileW
Sleep
GetVersionExW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

shell32

ShellExecuteW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96d00ede7a720bc70e3485a474efff8e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

shell32

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 17KB - Virtual size: 16KB