da55064051a441508ef898dbdf6788c4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

da55064051a441508ef898dbdf6788c4_JaffaCakes118
Size

680KB
MD5

da55064051a441508ef898dbdf6788c4
SHA1

ce2fe0521f01c2d30bf4795d0a2513fcf0123260
SHA256

9372af030b91a1451f80130fa8ce7703ddf6d3ed4824c3c0a77c180915927157
SHA512

cdfd3215c078482526a401fce1a1531511c4ebf329b799a9010c16ba7915f499374239c54a5178ee86bd0083b8ad09fbd4b2850d96a43aa4d5b0091471a1840a
SSDEEP

12288:vgGpG+Cxq/5j0fqW+q/1sscnQjeaRXebHEvSp9FbVCW1MaO52EhyjNkLHa:ozK4kd3QaFkvSp9FIWerxLa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da55064051a441508ef898dbdf6788c4_JaffaCakes118

Files

da55064051a441508ef898dbdf6788c4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ea022fde9440c383c03ce01749078516

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Boy\Desktop\WH\EXE\LoadEXE_Shuld_support98\LE999\LoadEXE_444\release\LoadEXE.pdb

Imports

kernel32

GetProcAddress
SetThreadContext
GetCommandLineA
LoadResource
SizeofResource
GetModuleHandleA
GetCurrentProcess
GetTempPathA
ResumeThread
FindResourceA
ExitProcess
GetLastError
HeapFree
HeapReAlloc
HeapAlloc
GetVersionExA
GetProcessHeap
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapSize
CloseHandle
RtlUnwind
RaiseException
MultiByteToWideChar
ReadFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetEndOfFile

shell32

ShellExecuteA

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 604KB - Virtual size: 601KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea022fde9440c383c03ce01749078516

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 604KB - Virtual size: 601KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 604KB - Virtual size: 601KB