ce3563d938ec5aa89c4c6f1c598ea3b2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce3563d938ec5aa89c4c6f1c598ea3b2_JaffaCakes118
Size

12KB
MD5

ce3563d938ec5aa89c4c6f1c598ea3b2
SHA1

b61c05980c16a0fa64aaa8e68748f8e638af0dab
SHA256

16dd3ffb68a81355bf81e8e85fc346e06031609d987366794f44b62659110185
SHA512

92e4b70dea476a3285b454e525840d164b5cbcbdb4e8d0f317d6bca82efedd88f5568c3ec29cf3af2375cdd74d71bee757348f361e53d0bd38ed1517b45cfa7b
SSDEEP

192:DnHk/ihp8Q6iw4HGkgKLFlufDXwVUcXd3fps5RvLCV40oyBLb+:DHVp8QqwfgKLFlcTktJRQRvLW1oyBLy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce3563d938ec5aa89c4c6f1c598ea3b2_JaffaCakes118

Files

ce3563d938ec5aa89c4c6f1c598ea3b2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\我的DBank\phoenix\phoenix_ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE