60bd5a9ab78f6c614b824ddcb47dfd7c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

60bd5a9ab78f6c614b824ddcb47dfd7c_JaffaCakes118
Size

422KB
MD5

60bd5a9ab78f6c614b824ddcb47dfd7c
SHA1

c876ec4c67c4c9529784483294f2e9f12d8d8930
SHA256

8fa3a56e3cfd923c32cb3c524bfd9525c7ea6e4dfa27872ed92cdd28474062e3
SHA512

68ebd92aca3e6a1564060fea699ac70553dc648c20c30e161aee7c04e051239fa3f8680f0dce1ee16c0217e0f4455c41e730d612e3b9265446e757fc5cff1ffe
SSDEEP

6144:SgY4LRY7dDyeeMFczlqy4EQvdMkN8dDm/iGemmpP231XtL2SP8AVpuPED3lZi+m:/jNYFTepzlD4RO6iLm2O1XtLN5uk1Zij

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60bd5a9ab78f6c614b824ddcb47dfd7c_JaffaCakes118

Files

60bd5a9ab78f6c614b824ddcb47dfd7c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2833deb4b4d2df46262cf89ef948bfd0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\Double\Door_wh\RbDoorX64\Release\RbDoor.pdb

Imports

kernel32

WriteFile
SetEndOfFile
CreateToolhelp32Snapshot
VirtualAllocEx
GetProcAddress
GetModuleHandleW
GetCurrentProcess
CreateRemoteThread
LoadLibraryA
VirtualFreeEx
WaitForSingleObject
SetLastError
GetModuleHandleA
CloseHandle
OpenProcess
GetLastError
Process32FirstW
Process32NextW
FlushFileBuffers
GetModuleFileNameA
DeleteFileA
GetTempPathA
GetTempFileNameA
CreateFileA
SetFileAttributesA
GetModuleFileNameW
SetFileAttributesW
WritePrivateProfileStringA
GetPrivateProfileIntA
ReadFile
SetFilePointer
ReadProcessMemory
CreateFileW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
Sleep
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize

advapi32

LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 367KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2833deb4b4d2df46262cf89ef948bfd0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 367KB - Virtual size: 374KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 367KB - Virtual size: 374KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 5KB - Virtual size: 4KB