215057ac490b0c2564becb8482330d67_JaffaCakes118 | Triage

Sharing

General

Target

215057ac490b0c2564becb8482330d67_JaffaCakes118
Size

2.5MB
MD5

215057ac490b0c2564becb8482330d67
SHA1

e2fa1ce5ad9e2ba104ae9a2403455b465e7b28c1
SHA256

dcd5e8958f299309d859ac081d0a64cc34a12d609185889ebbdda833b1319b5f
SHA512

4e73d36d6a2461943a324a591dfd3e9ee2c43972ec0e0eb6e6bd75becbecd0858a738e8a51dc6eef152accab31301991b1562929e5cd5b8c0288bf89a5be4c8b
SSDEEP

49152:nY9MWFHW4vzYvqM0VS0/C2FGthbTzErAbCS:sDF2OzYvyVt/4hbTzQAbt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
215057ac490b0c2564becb8482330d67_JaffaCakes118

Files

215057ac490b0c2564becb8482330d67_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b144870e3a37e200b228432e9ff61d95

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
GetProcessHeap
CloseHandle
QueryPerformanceCounter
ReadFile
SetFilePointer
CreateFileA
ExitProcess
GetModuleFileNameA
Sleep
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE