b1588194e27b805ae774dfbebe5a4777_JaffaCakes118

General

Target

b1588194e27b805ae774dfbebe5a4777_JaffaCakes118
Size

400KB
MD5

b1588194e27b805ae774dfbebe5a4777
SHA1

1729f63f626477d3e8543b5de3038096b12922cf
SHA256

0d20388e4194627d4353e2a0ef2f813be5c6282257a80896a06c3e752f973a59
SHA512

5ceeae68b26c5cc1d726f38f95f77b88159bdeef0d1ab8e58b6daa6c8d35c8f8c45ee9ddd255c7a2707bb8313026aa8ebd8db18fef164b383e2daa07965a94c1
SSDEEP

6144:26MFFuRd8rIDEPbTl6mo8F9JE3feefbUd6+APZ/NiRBNGAH3TyoeZ8g:eFF+D66mo8iPFUd6VPZ/NohO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1588194e27b805ae774dfbebe5a4777_JaffaCakes118

Files

b1588194e27b805ae774dfbebe5a4777_JaffaCakes118
.exe windows:4 windows x86 arch:x86

edea2af8bd47af3aba7531aed2dc3894

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\guide\region\boy\captain\together\blue\loudago.pdb

Imports

kernel32

PrepareTape
VirtualProtect
GetWindowsDirectoryA
GetLastError
CloseHandle
GetFileType
CreateFileA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
SetHandleCount
GetStdHandle
DeleteCriticalSection
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile
ReadFile
SetFilePointer
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
SetLastError
GetCurrentThreadId
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
InitializeCriticalSection
HeapAlloc
FatalAppExitA
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetSystemInfo
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 698KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

edea2af8bd47af3aba7531aed2dc3894

Headers

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 152KB - Virtual size: 151KB

.rdata Size: 124KB - Virtual size: 121KB

.data Size: 116KB - Virtual size: 698KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 152KB - Virtual size: 151KB

.rdata
Size: 124KB - Virtual size: 121KB

.data
Size: 116KB - Virtual size: 698KB

.rsrc
Size: 4KB - Virtual size: 1KB