c783044fba8e91135229fcd3c853c856_JaffaCakes118

General

Target

c783044fba8e91135229fcd3c853c856_JaffaCakes118
Size

21.0MB
MD5

c783044fba8e91135229fcd3c853c856
SHA1

b993da5a983388d3f958113ea8f0d9628172ea84
SHA256

1a5d4b1358cfc8be4d096458965a6e6c3799f0debae2c74030b314e9875e3c44
SHA512

ad979f24bfdd59742d4e4dd59213ad2cfa6814f7622dad96f8b03cb7d4e72cc46d499348acacedf5b24df6e2066a5efd7d9d8cf09901070a51ee1fb88d213ac9
SSDEEP

12288:bMH3x4X+oz6UUWZT5HMpMyBrXwuGtnxMuWkNfxp:KtUrbEMeXwXFxM6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c783044fba8e91135229fcd3c853c856_JaffaCakes118

Files

c783044fba8e91135229fcd3c853c856_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6adc857dff032d74bd8ee397d69863ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Kunden\Codesoft-PW-Stealer_v0.5\0e0 Version\Release\Codesoft-PW_Stealer_Server.pdb

Imports

kernel32

lstrcatA
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
GetLastError
CreateMutexA
GetCurrentProcess
CreateFileA
GetModuleHandleA
lstrcpyA
GetModuleFileNameA
ExitProcess
lstrcmpA
ReadProcessMemory
CloseHandle
GetFileSize
lstrlenA
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

advapi32

GetUserNameA
RegOpenKeyExA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mappis
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 484KB - Virtual size: 482KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6adc857dff032d74bd8ee397d69863ee

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 40KB - Virtual size: 37KB

.mappis Size: 44KB - Virtual size: 41KB

.rsrc Size: 484KB - Virtual size: 482KB

.text
Size: 40KB - Virtual size: 37KB

.mappis
Size: 44KB - Virtual size: 41KB

.rsrc
Size: 484KB - Virtual size: 482KB