a4c3db580376fca1c52f4cd1745ed62d_JaffaCakes118

General

Target

a4c3db580376fca1c52f4cd1745ed62d_JaffaCakes118
Size

76KB
MD5

a4c3db580376fca1c52f4cd1745ed62d
SHA1

00b7b2d1c755e4ce462250665309a6b973dd34d3
SHA256

243577153c70fc96ed7be519d2debc05ecd3927229bda49b584d4b08c0ef18d5
SHA512

24abf6cd069504a3a99a5d40734f1c446426a0776708dc88602b3bae20be115004e9feb9918ced4ecab76e1b8b861e7d45fb1ee12fb7843387a544c242ad8b9d
SSDEEP

1536:lVH+PdCpyerezRVBDDrPvWeB/o31nk+M2reWJ3fz3cv:PH+AppiVBDDjvlM1gqeWJvjc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4c3db580376fca1c52f4cd1745ed62d_JaffaCakes118

Files

a4c3db580376fca1c52f4cd1745ed62d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c72c3bcfe0dfeb325af3e0f9dc5ea1f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Source\RTS\Deploy\Debug\Deploy.pdb

Imports

kernel32

GetLastError
CreateMutexA
GetProcAddress
LoadLibraryA
ReleaseMutex
SetStdHandle
SetFilePointer
GetLocaleInfoA
VirtualQuery
Sleep
GetVersionExA
lstrcpyA
GetSystemInfo
VirtualProtect
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
DebugBreak
RaiseException
TerminateProcess
GetCurrentProcess
ExitProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
GetProcessHeap
CloseHandle
FreeLibrary
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetConsoleCtrlHandler
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FlushFileBuffers

user32

FindWindowA
wsprintfA
PostQuitMessage

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c72c3bcfe0dfeb325af3e0f9dc5ea1f7

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 7KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 7KB