010108d656d816634bfdf95d8411d8fa_JaffaCakes118

General

Target

010108d656d816634bfdf95d8411d8fa_JaffaCakes118
Size

60KB
MD5

010108d656d816634bfdf95d8411d8fa
SHA1

85438de8148624646d5a70f59d5be0ed08035225
SHA256

c934b509327c29f12da28d8dc607987bb6e1564670c4c2145b2396155d9d75ca
SHA512

c9fc219a4bb51f6e9b027f39ca8ac80f03d9276f4167059b65362a53d659a4814bcb3c54589d5616a4d066e5ffb2796c903527c5729652963c8a7d990bdde491
SSDEEP

768:/4Lk5tdXoCYyFf8R6+LtfMcLY2lNa+Bqhe1szdLUYbAQKDQb32a3LYudIsbI:/4wDdXRYkX+xpTlNRBqk1sKr8b/7PNU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
010108d656d816634bfdf95d8411d8fa_JaffaCakes118

Files

010108d656d816634bfdf95d8411d8fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1c8c192624d3f34f6904fd407399a4ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\源代码\无时间限制\test\Release\WhiteBoard.pdb

Imports

wsock32

WSAStartup
socket

kernel32

WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
CreateProcessA
lstrcatA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
GetLocaleInfoA
VirtualProtect
FindResourceA
UnhandledExceptionFilter
ExitProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
TerminateProcess
GetCurrentProcess
GetStdHandle
GetSystemInfo
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c8c192624d3f34f6904fd407399a4ce

Headers

File Characteristics

PDB Paths

Imports

wsock32

kernel32

advapi32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 28KB - Virtual size: 27KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 28KB - Virtual size: 27KB