240426-r6vdrsdh35_pw_infected[.]zip | Triage

Sharing

General

Target

240426-r6vdrsdh35_pw_infected.zip
Size

1.6MB
MD5

82bec33d863da1af5663d467b233fec7
SHA1

0b82f3e56fa30412d2f4e0e85046821b7d5e90e6
SHA256

8fdc2a142fcc96b6f6f39387f78abb2b8705014102ccb91e9df60fe761a4cb12
SHA512

a6ace30d3dbde2c1d209517ce078662fddbd3d98f83e4736848dedf4bcdc16dabfcd324ad6fe6fb6f21c18e68197a6293f0cb03b9e4c0bdf4c3f397ed3e6c02d
SSDEEP

49152:Hh1fQmSr1nEidH97uJpv+KBbSX77N0Uh96a0w5BHlZ4ace2t:jkrR97uJpvnw77N0O17lWk2t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/01028b2b86548e8c91fc9db5aca4cad2_JaffaCakes118

Files

240426-r6vdrsdh35_pw_infected.zip
.zip

Password: infected
01028b2b86548e8c91fc9db5aca4cad2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2e5708ae5fed0403e8117c645fb23e5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA

msvcrt

free
_initterm
malloc
_adjust_fdiv
sprintf

Exports

Exports

PlayGame

Sections

.text
Size: 4KB - Virtual size: 652B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ