e239466cdb398cf55772ba0d3c788f25_JaffaCakes118

General

Target

e239466cdb398cf55772ba0d3c788f25_JaffaCakes118
Size

52KB
MD5

e239466cdb398cf55772ba0d3c788f25
SHA1

92e48bd576ac5df36dddee74e2eb7803a7759862
SHA256

d110bb7580e7f0a7e0752dddf6ceef1221e66051e6a68b76d4d208aafcad78f8
SHA512

5c42b4d68a0f903fb1087affb879b67c70805b6439309b6d9eb6dc54cd97cd51faebba01f4c8a4f66895f0d265ab803c39425e4a42034adfdbecbf9ff1c6a57f
SSDEEP

768:bNUC6JgAaEcY9dYKdd35t2JsOdkEt2I18ZNfss0YPZlQO:JMFncY9dYKSVdkm2I1YfjXlN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e239466cdb398cf55772ba0d3c788f25_JaffaCakes118

Files

e239466cdb398cf55772ba0d3c788f25_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdfb6a5a5436a32ce5a0aa1ca4cffd54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Ces\Suxod\edif.pdb

Imports

kernel32

QueryPerformanceCounter
CreateFileA
GetVolumeInformationA
GetSystemTime
OpenProcess
GetVersionExA
GetModuleHandleA
GetDateFormatA
GetProfileStringW
LoadResource
FindResourceA
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
SetEndOfFile
HeapSize
VirtualQuery
InterlockedExchange
RtlUnwind
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetLastError
CloseHandle
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
SetFilePointer
ReadFile
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
FlushFileBuffers
LoadLibraryA
GetACP
GetSystemInfo

shlwapi

SHDeleteKeyA
PathIsDirectoryA
PathFindFileNameA
PathFileExistsA
PathCanonicalizeA

ws2_32

WSACreateEvent
WSAGetOverlappedResult
WSAConnect
WSAWaitForMultipleEvents
WSACloseEvent
getservbyport
socket
setsockopt
getservbyname
getprotobynumber
WSASocketA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdfb6a5a5436a32ce5a0aa1ca4cffd54

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

ws2_32

Sections

.text Size: 36KB - Virtual size: 35KB

.data Size: 8KB - Virtual size: 227KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 35KB

.data
Size: 8KB - Virtual size: 227KB

.rsrc
Size: 4KB - Virtual size: 1KB