f987a4970911ca27546310ef69cfcb23_JaffaCakes118

General

Target

f987a4970911ca27546310ef69cfcb23_JaffaCakes118
Size

80KB
MD5

f987a4970911ca27546310ef69cfcb23
SHA1

a5279e06bf41ef4e124040bc2f9bdd90abc47e7f
SHA256

51740b842012f0e596c61e072f099aceb12dc6c1f8608ffdcdc546d2e11da5d9
SHA512

7afc827bbb43113d38c5655b42a00d95db78a13b256158fcbb6ea96928a78ef2c3a9e8ec7a2bbcba728a9ebe0415eefc9341b61947e274a1c0c761961a7266f0
SSDEEP

768:4IRw/UTkJ01TJuZqckkmsDwelHmZU9QZU9:4aw/50BJEqFQlGz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f987a4970911ca27546310ef69cfcb23_JaffaCakes118

Files

f987a4970911ca27546310ef69cfcb23_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2b2776e18ac691f5f83fecd591a33003

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\MyDev\VC7\KillProcess\KillProcess\Release\KillProcess.pdb

Imports

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

kernel32

WideCharToMultiByte
VirtualProtect
GetLocaleInfoA
GetStringTypeW
CloseHandle
TerminateProcess
lstrcmpA
OpenProcess
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetSystemInfo
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapReAlloc
HeapAlloc
HeapSize
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b2776e18ac691f5f83fecd591a33003

Headers

File Characteristics

PDB Paths

Imports

psapi

kernel32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 48KB - Virtual size: 47KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 48KB - Virtual size: 47KB