028b93c5b33b2a97ed2382b1c87e5e4e_JaffaCakes118

General

Target

028b93c5b33b2a97ed2382b1c87e5e4e_JaffaCakes118
Size

1000KB
MD5

028b93c5b33b2a97ed2382b1c87e5e4e
SHA1

9ffbe0ffa2bf2fab0741fa9d52d4625c817f7249
SHA256

e93604ab93ff1358a602d72f05923daf79c08e0391f669afe46b212a70d1b09c
SHA512

dc6a5b794f1549e070b45d6c7ddc232f84709fc6acf259ec4e55822f019cbf611965f848accac4a94ed4f5b346bf1d5e60c124fa82d6f149f3d84a614ec59f44
SSDEEP

12288:8G+Z0dlqi+Oqyg3ErM5kt4BgtQxIrmzKFA0Jrs62KQrqI:8G+ZwqDFy2eEpIBFGKQr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
028b93c5b33b2a97ed2382b1c87e5e4e_JaffaCakes118

Files

028b93c5b33b2a97ed2382b1c87e5e4e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

00f00fd835cea4efd55f37f091ba1f65

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Kunden\Codesoft-PW-Stealer_v0.5\Tscheppi Version\Release\Codesoft-PW_Stealer_Server.pdb

Imports

kernel32

lstrcatA
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
GetLastError
GetCurrentProcess
CreateFileA
GetModuleHandleA
lstrcpyA
ExitProcess
lstrcmpA
ReadProcessMemory
CloseHandle
GetFileSize
lstrlenA
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

advapi32

GetUserNameA
RegOpenKeyExA

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.2355443
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 492KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00f00fd835cea4efd55f37f091ba1f65

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 40KB - Virtual size: 37KB

.2355443 Size: 64KB - Virtual size: 60KB

.rsrc Size: 492KB - Virtual size: 488KB

.text
Size: 40KB - Virtual size: 37KB

.2355443
Size: 64KB - Virtual size: 60KB

.rsrc
Size: 492KB - Virtual size: 488KB