36ef4c3a615469b4707436d040bf33fc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36ef4c3a615469b4707436d040bf33fc_JaffaCakes118
Size

12KB
MD5

36ef4c3a615469b4707436d040bf33fc
SHA1

35947fd61f5752db47d170a30fc607e35794d078
SHA256

7a54279809e1d678bf72638c82bb4d459ae232033cb8e5fa8bc5ab55e7003747
SHA512

2aa69d0c761f11ec4fd42390bed6364a0e6c611f7a5ec97ed913cdd835618e8de14114ae47026e02d16a74a931b66ea3c2572ce1ae3698e4922f7f03f5080ff8
SSDEEP

192:enHk/ihp8Q6iw4HGkgKLFlufDEwVUcXd3fps5RvLCV40oyBLbOR:eHVp8QqwfgKLFlcYktJRQRvLW1oyBLq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36ef4c3a615469b4707436d040bf33fc_JaffaCakes118

Files

36ef4c3a615469b4707436d040bf33fc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

158033360a45f5ad3da650dbdf26d2dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\phoenix\Feng\Phoenix_Ultimate\release\ldrosr.pdb

Imports

kernel32

FlushInstructionCache
GetProcAddress
VirtualProtectEx
GetModuleHandleA
CloseHandle
WriteProcessMemory
SuspendThread
ResumeThread
FreeLibrary
CreateProcessW
SetThreadContext
GetModuleHandleW
GetThreadContext
Process32NextW
LoadLibraryW
OpenProcess
OutputDebugStringW
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
GetStartupInfoW
GetCommandLineW
lstrcpyW
lstrlenW
GetStdHandle
GetStringTypeW
lstrcmpiW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

wvsprintfA
wvsprintfW
FindWindowW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE