beb4be27bba65645903d1418048d1966_JaffaCakes118

General

Target

beb4be27bba65645903d1418048d1966_JaffaCakes118
Size

552KB
MD5

beb4be27bba65645903d1418048d1966
SHA1

ddedef751715a08232ee35c3f93127be1ba5096b
SHA256

1365ad8789a78566daf5f4eaeb200eafb1a5a513110b3e9242396d24ca256d68
SHA512

fbbc804cdfd64f400bde34433bbea25a395090115d6f536a225c17bf51721373d893b5f2b1b0015a4695e7b70f39abb459122f6b381de632ec0e4b9e82d6fa41
SSDEEP

12288:+Os+pXonQ2tohiNHKy97lzXdZQKNgGBG3Oy9hkHdUZ:K+CQJhAFX/NRyDedY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
beb4be27bba65645903d1418048d1966_JaffaCakes118

Files

beb4be27bba65645903d1418048d1966_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6adc857dff032d74bd8ee397d69863ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Kunden\Codesoft-PW-Stealer_v0.5\1337Lexx Version\Release\Codesoft-PW_Stealer_Server.pdb

Imports

kernel32

lstrcatA
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
GetLastError
CreateMutexA
GetCurrentProcess
CreateFileA
GetModuleHandleA
lstrcpyA
GetModuleFileNameA
ExitProcess
lstrcmpA
ReadProcessMemory
CloseHandle
GetFileSize
lstrlenA
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

advapi32

GetUserNameA
RegOpenKeyExA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mappis
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 464KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6adc857dff032d74bd8ee397d69863ee

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 40KB - Virtual size: 37KB

.mappis Size: 44KB - Virtual size: 41KB

.rsrc Size: 464KB - Virtual size: 462KB

.text
Size: 40KB - Virtual size: 37KB

.mappis
Size: 44KB - Virtual size: 41KB

.rsrc
Size: 464KB - Virtual size: 462KB