78353cdbf474eac2de06f3a6a5bb6810_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

78353cdbf474eac2de06f3a6a5bb6810_JaffaCakes118
Size

74KB
MD5

78353cdbf474eac2de06f3a6a5bb6810
SHA1

1b4301cd845243719e0ea5f7f5dd20dc3fa7039b
SHA256

b015cc3ccea659c26933fcc5d4d566908ffaf7e77c2bbbdff5adcc104f1f00dc
SHA512

befdb3e9b81ee630a022ec5b8530dec0f58a1ac700aac54c0cdcbe9f017dec7500ef7e6505fc577bffd9311d4100638372d96850471c5d4f00df2a4d0da42934
SSDEEP

1536:7c6yChoZLshUTJ++Knkc1enU75t4LJ0R:7c6hoZLPCeni5t4LJ0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78353cdbf474eac2de06f3a6a5bb6810_JaffaCakes118

Files

78353cdbf474eac2de06f3a6a5bb6810_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ee4901b7dc83a3b1a33f46b2f5298036

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\我的文档\PE\ieSpy\Release\ieSpy.pdb

Imports

kernel32

Sleep
lstrlenW
GetModuleFileNameA
GetWindowsDirectoryA
DeleteFileA
CopyFileA
WinExec
WaitForSingleObject
CreateMutexW
GetLastError
CloseHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoA
GetCurrentProcess
TerminateProcess
OpenProcess
GetModuleHandleW
lstrcpyA
InterlockedDecrement
GetStringTypeW
GetStringTypeA
GetModuleHandleA
HeapSize
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetProcessHeap
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
HeapAlloc
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree

user32

DdeUninitialize
DispatchMessageW
TranslateMessage
LoadStringW
DdeNameService
DdeCreateStringHandleW
MessageBoxW
DdeInitializeW
wsprintfA
ShowWindow
FindWindowW
SetTimer
DdeQueryStringW
KillTimer
GetMessageW

advapi32

LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges

ole32

CoCreateInstance
OleRun
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysFreeString
SysAllocString
GetErrorInfo

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee4901b7dc83a3b1a33f46b2f5298036

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

psapi

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 576B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 576B

.reloc
Size: 6KB - Virtual size: 5KB