2f76df8ea0d3a7a25c1fcc7d0cdd6d47_JaffaCakes118

General

Target

2f76df8ea0d3a7a25c1fcc7d0cdd6d47_JaffaCakes118
Size

36KB
MD5

2f76df8ea0d3a7a25c1fcc7d0cdd6d47
SHA1

742ccc1971923241fa7403791c9cef5253987e5e
SHA256

e1e13aeb0216e6fd310d15c5a30a19f16737a2b55541cf2028453b0b968062ec
SHA512

19b00165ca537a9014e878f0001326d8ccff7390905d0a7ae4040c4bedf1248ec755d4890a58fad35771b909d5f8a06b0c2620647444822b078d69a130f7f4d7
SSDEEP

384:eWjyzDkiTaqRMbdalc5Fx0ZEHQofu06Pza26ClsyqoK3jvYl:QDkiTCJQMxmGgP36gSnzQl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f76df8ea0d3a7a25c1fcc7d0cdd6d47_JaffaCakes118

Files

2f76df8ea0d3a7a25c1fcc7d0cdd6d47_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2657a23935abc1f696e037d0f252148c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\桌面\实练1\funproc\Release\funproc.pdb

Imports

kernel32

GetLastError
CreateRemoteThread
GetProcAddress
GetModuleHandleA
CloseHandle
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
ExitProcess
CreateProcessA
Sleep
CopyFileA
GetModuleFileNameA
GetSystemDirectoryA
CreateMutexA
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetLocaleInfoA
GetCPInfo
RtlUnwind
InterlockedExchange
LoadLibraryA
GetACP
GetOEMCP
HeapSize
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2657a23935abc1f696e037d0f252148c

Headers

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 2KB