ea9f2792f1fade5da9feef5035bf6432_JaffaCakes118

General

Target

ea9f2792f1fade5da9feef5035bf6432_JaffaCakes118
Size

276KB
MD5

ea9f2792f1fade5da9feef5035bf6432
SHA1

b85461b85e9731f2d86293d6b7509c4aa66a08cc
SHA256

c884298616acba5e30b18fed19b37d704df6f888fa92b635497a385bb5f30023
SHA512

0589149e1daea5b30e8dceadd192dbe0669f7a62321fe91411c515e3cc75b15dc12433b3d7b1a8277a653f4ad5f14d050ab2890cb6d59fe9fabfa8f0ce0594bb
SSDEEP

3072:atyzPlm9zP96QoR6l1ESCqyp2Vdwrw5RPtGyfxtoeGAv/yOItvjUJNsdMRIApG5E:atyQzPv+bed1GyfxB85WO0esgTaP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea9f2792f1fade5da9feef5035bf6432_JaffaCakes118

Files

ea9f2792f1fade5da9feef5035bf6432_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8181764fab62f3373cd953deec0b9f18

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Backup\我的文档\Visual Studio Projects\dog\arp\Release\Arp.pdb

Imports

kernel32

LoadResource
FindResourceA
Sleep
CreateProcessA
SizeofResource
ExpandEnvironmentStringsA
GetModuleHandleA
GlobalFree
GlobalAlloc
CreateFileA
DeleteFileA
RemoveDirectoryA
WriteFile
FlushFileBuffers
FreeResource
GetTempFileNameA
CloseHandle
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetLastError
SetFilePointer
GetStdHandle
HeapFree
HeapAlloc
WideCharToMultiByte
GetProcAddress
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle
VirtualFree
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
LCMapStringA
GetSystemInfo

advapi32

CreateServiceA
OpenServiceA
CloseServiceHandle
ControlService
DeleteService
StartServiceA
OpenSCManagerA

ws2_32

gethostname
gethostbyname
inet_ntoa
WSACleanup
WSAStartup

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8181764fab62f3373cd953deec0b9f18

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ws2_32

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 240KB - Virtual size: 237KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 240KB - Virtual size: 237KB