8aca946d4c6b5ca9486865b73c112532_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8aca946d4c6b5ca9486865b73c112532_JaffaCakes118
Size

97KB
MD5

8aca946d4c6b5ca9486865b73c112532
SHA1

a9e1033cb0dbc31647b32789c6457297ec151eb4
SHA256

9c3c565ff3c0b209e516a3a5f23af0314b0536eb2436b79c819c30a84e806481
SHA512

aac51f653831b167496d9605273b805f827f21873d6744d8813b1c89cbfee869df9f35f5daed65089b2d838af4b6a0776689b13577673d525fa5c15c8a3c056f
SSDEEP

1536:B8Lk5iN9u8StacVL2uIiJphkpOuXCXyrGlhM4Qg/vcl35lBnC:Ak5iN9u8StacdZ3kpZjGlh1ABC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8aca946d4c6b5ca9486865b73c112532_JaffaCakes118

Files

8aca946d4c6b5ca9486865b73c112532_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d60e0d99a8c91947bbe89965b35747df

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\-- dsnop --\!! Project - 2006-08-08 - Fith\Coding for Fith\Fith - Packer - Exe Runner - 000 - from demical packer 003\Release\ExeRunner.pdb

Imports

kernel32

GetFileSize
CreateFileA
Sleep
GetSystemDirectoryA
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
ReadFile
LCMapStringA
GetCPInfo
GetOEMCP
GetACP
HeapSize
GetFileAttributesA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetTempPathA
CloseHandle
WriteFile
GetModuleFileNameA
GetModuleHandleA
FindResourceA
SizeofResource
MultiByteToWideChar
LoadResource
HeapFree
ExitProcess
HeapAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessA
GetProcAddress
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetHandleCount
GetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
LoadLibraryA
InterlockedExchange
VirtualQuery
GetSystemInfo

user32

LoadAcceleratorsA
LoadIconA
LoadCursorA
RegisterClassExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
BeginPaint
EndPaint
PostQuitMessage
MessageBoxA
EndDialog
GetDesktopWindow
GetWindowRect
CreateWindowExA

advapi32

ControlService
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
ChangeServiceConfig2A
CloseServiceHandle
OpenSCManagerA

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d60e0d99a8c91947bbe89965b35747df

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 36KB - Virtual size: 34KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 96KB - Virtual size: 94KB

.rrdata Size: 68KB - Virtual size: 68KB

.text
Size: 36KB - Virtual size: 34KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 96KB - Virtual size: 94KB

.rrdata
Size: 68KB - Virtual size: 68KB