5afa04ec0bd00aee8f0bb18c7db5fe6a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5afa04ec0bd00aee8f0bb18c7db5fe6a_JaffaCakes118
Size

12KB
MD5

5afa04ec0bd00aee8f0bb18c7db5fe6a
SHA1

b4347a2642d1ad53c2a911e68ac387ffce80738b
SHA256

5b1127e5e2238f483bdbab0b9079cf6c2838e47af5be0625c7f14c07c27cc230
SHA512

3beb57ac343411eb7ddb8d937d970dbed1a5ba9d5715a907ca73eed5302dcdfd52e083ea481ab19908719023c4ac717e0fc7e6058d026453747f50b57ff947ad
SSDEEP

192:znHk/ihp8Q6iw4HGkgKLFlufDz3wVUcXd3fps5RvLCV40oyBLby:zHVp8QqwfgKLFlc3ktJRQRvLW1oyBL+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5afa04ec0bd00aee8f0bb18c7db5fe6a_JaffaCakes118

Files

5afa04ec0bd00aee8f0bb18c7db5fe6a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Game\PHO\Phoenix_Ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE