ab2ab00e1ff7fd7a93ed0ad8001ccf43_JaffaCakes118 | Triage

Sharing

General

Target

ab2ab00e1ff7fd7a93ed0ad8001ccf43_JaffaCakes118
Size

12KB
MD5

ab2ab00e1ff7fd7a93ed0ad8001ccf43
SHA1

73ee50f49e45401bb791a99751d586dcdd40663e
SHA256

83e607a560a2f44f616c575a3fd9b4992e8efb3af71d968c681615cff49acd50
SHA512

41ef7e8aa267bb5220c57cb1f2e4bfa18ab0ddf29cba54f08bc489b1b06c0a90dfed1574889fb5b794fdac7d0c089a3a3cb4e4dad002776ab6bdb3baaa0fefa8
SSDEEP

192:knHk/ihp8Q6iw4HGkgKLFlufDOwVUcXd3fps5RvLCV40oyBLbWq:kHVp8QqwfgKLFlcyktJRQRvLW1oyBL/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab2ab00e1ff7fd7a93ed0ad8001ccf43_JaffaCakes118

Files

ab2ab00e1ff7fd7a93ed0ad8001ccf43_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\phoenix\Feng\Phoenix_Ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE