dd036008ee9776504460397f3adc1e66_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dd036008ee9776504460397f3adc1e66_JaffaCakes118
Size

142KB
MD5

dd036008ee9776504460397f3adc1e66
SHA1

6f1e739cefd38c13cdcb3e296bcd9408ca56309f
SHA256

ce8fd01dc7b2340e4b59d3abeadccb8d18d746ade9acbc6766943b8487978dec
SHA512

528e7e6543481f0ad24f0715735bf780c6bc744bdcd9a7ed03852581351106feedcf10d0ed4ced68f479e28888f481f4df036b290277c5497e3a2d11c9b60cf3
SSDEEP

1536:ASfBKZsvS2067fPLytqhRRR3HZnxPAwLALHVbx1bZG0TSwS1xIHW3:1fysaeIqhHVHrZCHVpkIHW3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd036008ee9776504460397f3adc1e66_JaffaCakes118

Files

dd036008ee9776504460397f3adc1e66_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fe29da9383912b4372f860c604aa9313

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

U:\1-AventoSoft\05-EasyInventory\9-Installation\9-EasyPortable\8-Helper\1-RunStickInventory\Release\RunStickInventory.pdb

Imports

kernel32

CreateProcessA
SetErrorMode
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringW
HeapReAlloc
HeapAlloc
RtlUnwind
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
Sleep
HeapFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetLastError
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetStringTypeW

user32

LoadStringA
LoadAcceleratorsA
DialogBoxParamA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
GetDesktopWindow
GetWindowRect
MoveWindow
SetDlgItemTextA
DefWindowProcA
DestroyWindow
BeginPaint
EndPaint
PostQuitMessage

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe29da9383912b4372f860c604aa9313

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 63KB - Virtual size: 66KB

.rsrc Size: 50KB - Virtual size: 50KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 63KB - Virtual size: 66KB

.rsrc
Size: 50KB - Virtual size: 50KB