09fa44863ad84175af40342d00f94e06_JaffaCakes118 | Triage

Sharing

General

Target

09fa44863ad84175af40342d00f94e06_JaffaCakes118
Size

810KB
MD5

09fa44863ad84175af40342d00f94e06
SHA1

a12d7fee2fb945f7e1308c8d2d3f53353afd97d5
SHA256

51e1df648ab29ffff9b20095639d6f2825988c219c0b48122cc29f7a3d7cabbe
SHA512

ed8e18929324fb6a332e24957796ee0e95b97c1760c9ec4fce4a8948e80883cf0ea4cbb666d2d7ab5555d00149b2105e10f6c238d615c9ade4254c744f70a43f
SSDEEP

12288:waCfbqHNucxW0QuDANdEf+KidUG1ftlSASodNJi2VUpV0GAfqXFXN6:wlf+twfa6aiH+A/rJ7Vi0GIqXFd6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09fa44863ad84175af40342d00f94e06_JaffaCakes118

Files

09fa44863ad84175af40342d00f94e06_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4399a9655910fede80a7d0d00b533276

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
QueryPerformanceCounter
HeapDestroy
HeapFree
Sleep
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
ReadFile
SetFilePointer
CreateFileA
ExitProcess
GetModuleFileNameA
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE