c170225eed8b218ab76867d01a7ef0cc_JaffaCakes118

General

Target

c170225eed8b218ab76867d01a7ef0cc_JaffaCakes118
Size

608KB
MD5

c170225eed8b218ab76867d01a7ef0cc
SHA1

394173815273d50efa311c466fb6286c83587a3d
SHA256

d9736dab2850a1be5b01d463f026da7e2c1a38061d619be7a56051ead9acadea
SHA512

afe9d3e67a8d71e103dca2b0347c8faebca983a565c0459f2ff54e081aa6ce254aba26be12feaaf152147fed3702edf1898be4306914d2bc5dabc332d8705aa5
SSDEEP

12288:Y06KRpN4kPCsoXra9QAAFA/5Hw1SmMjiKEVstlDqx:B6KRploba9wA/5Hw150wsl2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c170225eed8b218ab76867d01a7ef0cc_JaffaCakes118

Files

c170225eed8b218ab76867d01a7ef0cc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

178d4274b35d8ba003a7dd072acb09a0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Kunden\Codesoft-PW-Stealer_v0.5\ch0sen Version\release\Codesoft-PW_Stealer_Server.pdb

Imports

kernel32

GetLastError
CreateMutexA
GetCurrentProcess
Sleep
lstrcatA
lstrcpyA
GetFileSize
LoadLibraryA
GetModuleFileNameA
CloseHandle
CreateFileA
GetSystemDirectoryA
ExitProcess
lstrcmpA
ReadProcessMemory
GetProcAddress
GetModuleHandleA
lstrlenA
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

advapi32

GetUserNameA
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mappis
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 520KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

178d4274b35d8ba003a7dd072acb09a0

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

Sections

.text Size: 40KB - Virtual size: 38KB

.mappis Size: 44KB - Virtual size: 42KB

.rsrc Size: 520KB - Virtual size: 516KB

.text
Size: 40KB - Virtual size: 38KB

.mappis
Size: 44KB - Virtual size: 42KB

.rsrc
Size: 520KB - Virtual size: 516KB