d0d0cd54e2cf4aefd186c10856d720da_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d0d0cd54e2cf4aefd186c10856d720da_JaffaCakes118
Size

368KB
MD5

d0d0cd54e2cf4aefd186c10856d720da
SHA1

9cde93575aadec758669b4428d627998b5d64a8c
SHA256

46657ac4a0448127c4588509e33add313be91fbf6704cc95013f6ac522905aba
SHA512

4cedcdab392c39d161f44cf182b646985b348c457c6f4af5a1ca60a54e689beaa9d7b622fabd42d156deef1a4a45175bffec687ded0d898516c676fa5dc646f9
SSDEEP

6144:EZgnmQJIVmPEwUVmaujjVFtXINroWiW2BrTwPxHKzVS9qP/9XqtOwdzZu:dDEFVmaujjVFtXINroWiW2BrTwPxHKzi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0d0cd54e2cf4aefd186c10856d720da_JaffaCakes118

Files

d0d0cd54e2cf4aefd186c10856d720da_JaffaCakes118
.exe windows:4 windows x86 arch:x86

243e9fd0f9f88f1faa9ca4f171ad21b1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\桌面\33\Server\Release\Server.pdb

Imports

kernel32

GlobalAlloc
LoadResource
SizeofResource
FindResourceA
DeviceIoControl
CopyFileW
DeleteFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
LockResource
TerminateProcess
Thread32Next
GetCurrentThreadId
SuspendThread
Thread32First
DuplicateHandle
GetModuleFileNameW
CreateThread
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemInfo
VirtualProtect
GetCPInfo
GetOEMCP
GetACP
WriteFile
GlobalFree
GetProcAddress
LoadLibraryW
GetCurrentProcessId
OpenProcess
ExitProcess
GetSystemDirectoryW
MoveFileExW
lstrcpyW
GetTickCount
GetProcessHeap
HeapAlloc
HeapFree
Sleep
CreateFileW
GetFileTime
SetFileTime
lstrcatW
GetCurrentProcess
GetLastError
CloseHandle
GetModuleHandleW
LoadLibraryA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetFileType
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleFileNameA
InterlockedExchange
VirtualQuery
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize

user32

ShowWindow
SetWindowPos
UpdateWindow
wsprintfW
DefWindowProcW
CreateWindowExW
RegisterClassExW

advapi32

OpenProcessToken
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegEnumKeyW
RegDeleteKeyW
SetServiceStatus
CreateServiceW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
ChangeServiceConfigW
RegCreateKeyW
StartServiceW
EnumDependentServicesW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
DeleteService
LookupPrivilegeValueW
AdjustTokenPrivileges

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

243e9fd0f9f88f1faa9ca4f171ad21b1

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 36KB - Virtual size: 40KB

.rsrc Size: 272KB - Virtual size: 270KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 36KB - Virtual size: 40KB

.rsrc
Size: 272KB - Virtual size: 270KB