01348a6bb46ba935d3031bb5cbf5b3b2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

01348a6bb46ba935d3031bb5cbf5b3b2_JaffaCakes118
Size

180KB
MD5

01348a6bb46ba935d3031bb5cbf5b3b2
SHA1

70e4d8ee41bbadf7c83420e2b74d2ec04aa13c3f
SHA256

adc6e1c3756d0474e9b8cacef2d2ab65810f0f54c1579a3a9fb07901719fa8f0
SHA512

68a957e8abb2ff9afa3b2d67713926a75c560494d31bd72eea1da576541a4ff871d751baf7cfbff0e8c225148d8d6c4a7e5d12fb2afb8eb0a345f56167fb5f83
SSDEEP

3072:L3rXdYolGD0veatQxJtrK4LSZqLckUem27ri1vwBI+huFdb8MuTXR1:7hhvePPMqLckUet72FwBI+AFdb8Muj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01348a6bb46ba935d3031bb5cbf5b3b2_JaffaCakes118

Files

01348a6bb46ba935d3031bb5cbf5b3b2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

65f6fbc93f20cc5a62cfb2c52d0486ea

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\桌面\MediaBinder\Release\MediaBinder.pdb

Imports

kernel32

GlobalFree
CloseHandle
WriteFile
CreateFileA
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
DeleteFileA
Sleep
WinExec
CreateThread
CreateDirectoryA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
TerminateProcess
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
InitializeCriticalSection
VirtualAlloc
HeapReAlloc

user32

LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
RegisterClassExA
DefWindowProcA
BeginPaint
EndPaint
PostQuitMessage
CreateWindowExA
ShowWindow
UpdateWindow
LoadCursorA

shell32

ShellExecuteA

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65f6fbc93f20cc5a62cfb2c52d0486ea

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 140KB - Virtual size: 139KB

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 140KB - Virtual size: 139KB