e003ebf6a78735a7f8d354a3b016eba5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

e003ebf6a78735a7f8d354a3b016eba5_JaffaCakes118
Size

164KB
MD5

e003ebf6a78735a7f8d354a3b016eba5
SHA1

38385541dca94f34ccc168fa7591f60dcb322763
SHA256

0e16c0137ae3f6682a31af4cbe2aa963ae41754b40699ae661aa1888635657ef
SHA512

7f091b9833ff64ebfe32614f1daf61780c28eb5f03808a4b0d60ec18e1d08f81f9e7da6cf6f1b63bd7e13abc357d5ee8cb1501564aee6770b1ff2ca3ba398582
SSDEEP

1536:GbFvoLmrnllI7RSA1F6GKhVPUDTry4lwUMI4TjWqIOO0VBAU80Q6pLl:coLmk9zyVcDny89MI4TaqIOsU80fLl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e003ebf6a78735a7f8d354a3b016eba5_JaffaCakes118

Files

e003ebf6a78735a7f8d354a3b016eba5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

626f1ae38a5a62fdc20a163b018623ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\My Downloads\FileFuzz\src\bin\Debug\crash.pdb

Imports

kernel32

ReadProcessMemory
OpenProcess
GetThreadContext
OpenThread
ContinueDebugEvent
WaitForDebugEvent
GetLastError
GetCommandLineA
CreateProcessA
GetTickCount
GetVersionExA
GetModuleHandleA
IsBadWritePtr
IsBadReadPtr
HeapValidate
CloseHandle
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
RaiseException
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
SetStdHandle
FlushFileBuffers
SetConsoleCtrlHandler
CreateFileA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetProcessHeap
FreeLibrary
SetFilePointer
VirtualQuery
InterlockedExchange
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
ReadFile
VirtualProtect
GetSystemInfo
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetCurrentDirectoryA

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

626f1ae38a5a62fdc20a163b018623ba

Headers

File Characteristics

PDB Paths

Imports

kernel32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 40KB - Virtual size: 44KB

.idata Size: 4KB - Virtual size: 2KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 40KB - Virtual size: 44KB

.idata
Size: 4KB - Virtual size: 2KB