2eee5fc88edad183f52a0e3bca07262c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2eee5fc88edad183f52a0e3bca07262c_JaffaCakes118
Size

12KB
MD5

2eee5fc88edad183f52a0e3bca07262c
SHA1

d3ae549efa0f181092846720bb31b5eac39af43c
SHA256

7fadea73767e35ad2f3d16c21dcfbc6fa92b4645c5ffdace41fb7cc813833e59
SHA512

156d176674f7949935ad1bd5e82c8fe3eac01be704c817f477c587bb55966a650587b049f7749a592abaf84788993f6659570d58131610b8ad7f1d615b283198
SSDEEP

192:snHk/ihp8Q6iw4HGkgKLFlufDewVUcXd3fps5RvLCV40oyBLb4:sHVp8QqwfgKLFlcSktJRQRvLW1oyBLE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2eee5fc88edad183f52a0e3bca07262c_JaffaCakes118

Files

2eee5fc88edad183f52a0e3bca07262c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\我的DBank\phoenix\phoenix_ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE