fbe5121891b9a6688d70f1811c63d770_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fbe5121891b9a6688d70f1811c63d770_JaffaCakes118
Size

680KB
MD5

fbe5121891b9a6688d70f1811c63d770
SHA1

2de9b8e378acd8285587b8decc6ea7a175b662d7
SHA256

981d5fdf4980622c3a2cc052bcbd05a2f1eaa7ac83abcbd48849219f82749638
SHA512

517d02de69f3010bfb531ba67ab3e92904abc73c2de6f1bc8364649a8c6710233a86a1cf38058cf429805ceee5da93b74c0de2848239b49b01217c27869fd76f
SSDEEP

12288:vgGpG+Cxq/5j0fqW+q/1sscnQjeaRXebHEvSp9FbVCW1MaO52EhyjNkLHa:ozK4kd3QaFkvSp9FIWerxLa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbe5121891b9a6688d70f1811c63d770_JaffaCakes118

Files

fbe5121891b9a6688d70f1811c63d770_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ea022fde9440c383c03ce01749078516

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Boy\Desktop\WH\EXE\LoadEXE_Shuld_support98\LE999\LoadEXE_444\release\LoadEXE.pdb

Imports

kernel32

GetProcAddress
SetThreadContext
GetCommandLineA
LoadResource
SizeofResource
GetModuleHandleA
GetCurrentProcess
GetTempPathA
ResumeThread
FindResourceA
ExitProcess
GetLastError
HeapFree
HeapReAlloc
HeapAlloc
GetVersionExA
GetProcessHeap
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapSize
CloseHandle
RtlUnwind
RaiseException
MultiByteToWideChar
ReadFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetEndOfFile

shell32

ShellExecuteA

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 604KB - Virtual size: 601KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea022fde9440c383c03ce01749078516

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 604KB - Virtual size: 601KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 604KB - Virtual size: 601KB