0d8a49a7e487d2f2805a125cfa0931e7_JaffaCakes118 | Triage

Sharing

General

Target

0d8a49a7e487d2f2805a125cfa0931e7_JaffaCakes118
Size

641KB
MD5

0d8a49a7e487d2f2805a125cfa0931e7
SHA1

49ee821b31a8e113d8816e04f53372944501d0ed
SHA256

460a91934270e67a1105de840a43e35b550c726ebc4cedb91631720f7a336926
SHA512

a572976088187e7a93cd3cddd6acf009373b3ae17a7aa001bb73d48a67019dfaea80f7db39fbe9235df745992695e33fc6d5f1028fd208e6c3d949405dbaf085
SSDEEP

12288:/Bd52bW0Aqu4vv23fmcIfwT9uob0aHX5VVYqWpIM0JbeyDir:/BdRHQ4fJwwTt0gXASM0JbeEir

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d8a49a7e487d2f2805a125cfa0931e7_JaffaCakes118

Files

0d8a49a7e487d2f2805a125cfa0931e7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

77a16f241bbe5273536579b239d790da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

odbctrac

TraceSQLConnect
TraceSQLFetch
TraceSQLBindCol

kernel32

SetErrorMode
FindFirstFileA
FormatMessageA
CreateProcessW
GetSystemDirectoryA
SystemTimeToFileTime
GetEnvironmentVariableW
CreateSemaphoreA
GetVolumeInformationW
GetModuleHandleA
OpenFileMappingW
GetProcAddress
GetCurrentThread
Sleep
GetTickCount
ReadFile
OpenEventW
MapViewOfFile
HeapFree
GetFileAttributesW
HeapAlloc
CreateFileA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.yml
Size: 626KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ