83dd8f171c1ddabc529d61de1136a700_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

83dd8f171c1ddabc529d61de1136a700_JaffaCakes118
Size

17KB
MD5

83dd8f171c1ddabc529d61de1136a700
SHA1

5f285a3009d1e10803426d3c202f1bf531ac9e9e
SHA256

73df648404c7c65f63b904a0a7d7b60a273f894becc805187d45df59f097d2ee
SHA512

037c0d4b562a70bded4400fd35cc6f55f12add0a283490db81735d62131bb0664ebe8204813403c57f80ca1ef65e584b82d1093420d1d21f63abe4a670d4fa46
SSDEEP

384:QrdZICeAMewQYB5Aw2zLSXw5O3w6kOAmka:cIYwQtg3whQk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83dd8f171c1ddabc529d61de1136a700_JaffaCakes118

Files

83dd8f171c1ddabc529d61de1136a700_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4a97921da917f3f8abbb182e85e524ac

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

o:\Programmieren\Codesoft Releases\_NEW BETATEST\Trojka_Crypter_2.0\Bloody Version\release\stub.pdb

Imports

kernel32

Process32First
lstrcpyA
GetModuleFileNameA
GetModuleHandleA
CreateToolhelp32Snapshot
lstrlenA
GetProcAddress
DuplicateHandle
GetCurrentProcess
LoadLibraryA
CloseHandle
Process32Next
ReadFile
GetFileSize
CreateFileA
lstrcatA
GetTempPathA
LocalAlloc
LocalFree
CreateProcessA
IsDebuggerPresent
SetUnhandledExceptionFilter
Module32First
Module32Next
lstrcmpA
WriteFile
ExitProcess
UnhandledExceptionFilter
TerminateProcess
RtlUnwind

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyExA
GetUserNameA
RegQueryValueExA

shlwapi

PathFindFileNameA

Sections

.f0Gx
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ