03f46e897c5bda60bc73faa75a246210_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03f46e897c5bda60bc73faa75a246210_JaffaCakes118
Size

867KB
MD5

03f46e897c5bda60bc73faa75a246210
SHA1

f60f7bff2a2e87e56eecced870ee33f7e6eea9bb
SHA256

d949896e3a421d5b3f7fd7ed198754478279e676104e154061154d88465b3ba7
SHA512

e9866fe90b8ca6fc509d1b2c3e616dd8e0f0897ab47bbabb5a8c9d0f528b3cf3e086f75b121bf731490ef7c57b93541724beeab06911bc51ca3bf1d4c85609cc
SSDEEP

12288:ogvf8S/52ynap+7BjwUdfqWFSPo3woUAjB18aMdYNYGRekkQ2MXQY:LVy+tLvF52Ar8tkab8Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03f46e897c5bda60bc73faa75a246210_JaffaCakes118

Files

03f46e897c5bda60bc73faa75a246210_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1acea5f684ab87c141fd10cfd48da355

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

clusapi

ClusterControl
CloseClusterGroup

kernel32

MoveFileW
LoadLibraryExW
VirtualAlloc
LoadLibraryA
GetVersionExW
VirtualQuery

crypt32

CertSaveStore
CertGetNameStringA
CertCreateCRLContext
CryptMemFree
CryptEnumOIDInfo
CertNameToStrA
CertCreateContext
CertDeleteCTLFromStore
CryptDecodeMessage
CertFindCTLInStore
CryptMsgControl
CertControlStore
CertDuplicateCRLContext
CryptMemAlloc
CertOpenStore

Sections

.text
Size: 852KB - Virtual size: 852KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xml
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ