aceec62a7bf7b26a4a60b0d49bc84e8a_JaffaCakes118

General

Target

aceec62a7bf7b26a4a60b0d49bc84e8a_JaffaCakes118
Size

92KB
MD5

aceec62a7bf7b26a4a60b0d49bc84e8a
SHA1

a9ce9ab800c1ebb84f5d170e2155d8cc7acaa093
SHA256

91157b509aca277831cba85f1b20779e0788a959e87bdf03cff00edf82b75df4
SHA512

57eca1444112aca2025914fa95dca3b88eeae060614f2ae42aaa57a32ed9af39befae9c6dc5b240b6df0df1945b73b2d898a2323133107f7cb762fe3afde3641
SSDEEP

768:xlOyKwFZ9B+tXzPkOSw459DJotCdlPqqqqcZU9QZU9M:xl8whB+tXzsOF4HQOlPqqqqczD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aceec62a7bf7b26a4a60b0d49bc84e8a_JaffaCakes118

Files

aceec62a7bf7b26a4a60b0d49bc84e8a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c0cc5b1211a060e34633705ca532ab96

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\dezhou070531\Solution1\matrix\Release\matrix.pdb

Imports

shlwapi

StrTrimA

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
SetStdHandle
GetCPInfo
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
FlushFileBuffers
CloseHandle
CreateRemoteThread
GetProcAddress
WriteProcessMemory
VirtualAllocEx
OpenProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
Sleep
GetLocaleInfoA
VirtualProtect
GetModuleHandleA
HeapCreate
HeapFree
HeapAlloc
ExitProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapDestroy
GetSystemInfo
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetFilePointer
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0cc5b1211a060e34633705ca532ab96

Headers

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

advapi32

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 52KB - Virtual size: 48KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 52KB - Virtual size: 48KB