fcd20862d85bd2de9df3b12969ebc6cf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fcd20862d85bd2de9df3b12969ebc6cf_JaffaCakes118
Size

266KB
MD5

fcd20862d85bd2de9df3b12969ebc6cf
SHA1

ccc9323b37007e33fb7edde02035ac7e3273ddf9
SHA256

318350f245be5216a328f6c918da798d0b49581f9d94c79364fab19115904b83
SHA512

f5b2f67775ffc701f640c7d527348be2622ef66af5e764a292cfe78f79be056ef8431f09fa702fad03934d700f80c2581b9b0144a84cf174f0fdb8aa9327ca13
SSDEEP

6144:zbuI0g/4P7dvbQSFc8qa5PccoHF8w3hbSFg:vu04PREwc8qcoHF38g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcd20862d85bd2de9df3b12969ebc6cf_JaffaCakes118

Files

fcd20862d85bd2de9df3b12969ebc6cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b7ac57d17c948321cb90d09db6cde9fc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

o:\Programmieren\Codesoft Releases\_NEW BETATEST\Amaretto_Crypter\Noki3310 Version\release\Amaretto_Stub.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
LocalAlloc
GetModuleFileNameA
GetModuleHandleA
ContinueDebugEvent
IsDebuggerPresent
WaitForDebugEvent
CheckRemoteDebuggerPresent
lstrcmpA
LocalFree
lstrlenA
lstrcpyA
GetCurrentProcess
CreateProcessA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind

Sections

.f0Gx
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 181KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ