b899996033d7e8752025efdc6f704476_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b899996033d7e8752025efdc6f704476_JaffaCakes118
Size

58KB
MD5

b899996033d7e8752025efdc6f704476
SHA1

8f3417ce0e02ebf2866ab78d36922aefd4b7ec61
SHA256

fbb30a87b549c243f3de37c5f9657a4a948d6be5892993c41441a7a953d972b3
SHA512

df22a3f85985a1bac296df1f80b5b879ea2c18317077af74cb30b91d8660a687f6e4db21e2787b9f2fccccf3f5738491cd4b1b5d4e4c7cefbadd1442569ea479
SSDEEP

768:M/e4xvEdE/pilJslpbq/CcTwqq8uNhzGGfOnbORcTN6vTJekMEDqAn7rymMZ2h/4:MBoHs3bqqcJqDzGQcTNYTEkzQZW4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b899996033d7e8752025efdc6f704476_JaffaCakes118

Files

b899996033d7e8752025efdc6f704476_JaffaCakes118
.exe windows:5 windows x86 arch:x86

aaa86f71df9380add98e0b6c32edb116

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Administrator\桌面\新建文件夹\读取文件\Release\读取文件.pdb

Imports

shell32

SHGetSpecialFolderPathA

kernel32

TlsFree
GetTempPathA
CopyFileA
GetTickCount
SetEvent
WaitForSingleObject
IsBadWritePtr
VirtualProtect
VirtualQuery
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
HeapAlloc
RaiseException
GetLastError
HeapFree
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
CloseHandle
CreateFileA
MultiByteToWideChar
ReadFile
HeapSize
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SetFilePointer
SetEndOfFile
GetProcessHeap
LCMapStringW
GetStringTypeW
WriteConsoleW
CreateFileW

ws2_32

send

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aaa86f71df9380add98e0b6c32edb116

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

kernel32

ws2_32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 5KB - Virtual size: 4KB