eeadec85f7220719b6a4afb629ab1798_JaffaCakes118

General

Target

eeadec85f7220719b6a4afb629ab1798_JaffaCakes118
Size

11KB
MD5

eeadec85f7220719b6a4afb629ab1798
SHA1

e5251ccc7f8bec425fd590bcaf4b6ac0caebee36
SHA256

42f743cc56f1422b2bb13fad75bb57096f9e4eedf7fd0e29820014d5eadf8b13
SHA512

89a7a84b0aff711fd929a77df34255e291417556eb27b4c246cbf3529f885225a978b54abe2f9994b501e41afdb2bf7c2b42b70e3e1247d0f4a870eb7bb06cf1
SSDEEP

192:GDA92bEWzyX2YG5mHkwvIJDflx0wLQxHraGVzAOTvoCEP8JSVQHdp:X92EcwzEwvIJnQxLlOgJ1d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eeadec85f7220719b6a4afb629ab1798_JaffaCakes118

Files

eeadec85f7220719b6a4afb629ab1798_JaffaCakes118
.exe windows:6 windows x86 arch:x86

b8e8c112df02d8c95ee802b1533eba7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\工具\VC-项目\run\Release\run.pdb

Imports

kernel32

Process32First
CreateToolhelp32Snapshot
Process32Next
CloseHandle
GetProcAddress
FreeLibrary
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

shell32

ShellExecuteA

msvcrt

free
__set_app_type
abort
_XcptFilter
memset
?terminate@@YAXXZ
_controlfp_s
__getmainargs
_except_handler4_common
_amsg_exit
_errno
_environ
__argv
__argc
__p__commode
_c_exit
_cexit
_set_fmode
_exit
exit
_initterm_e
_initterm
__setusermatherr

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8e8c112df02d8c95ee802b1533eba7f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

msvcrt

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 488B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 488B