386ae2a6d0a1a032196c298b7bd8df3a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

386ae2a6d0a1a032196c298b7bd8df3a_JaffaCakes118
Size

10.4MB
MD5

386ae2a6d0a1a032196c298b7bd8df3a
SHA1

24f7337be84e4269fc78630ef158c2a2717e19e4
SHA256

ec7a3abfc5735180e787a0fa2306fe47f9dd56887fdfaadcc8f6a70a1db2f0db
SHA512

a7a6caee9a99ce46460397d3c931eaa97a5bb2fbc07f01d6b1d376d7baab06c670a437097c4f5db33fc09342317e228cb46a015af0bf0869d6510d639536913c
SSDEEP

12288:jESnARSpjYpQnTVlXhMe3wuf+Bn/0eHN/5i6AujtHVIVpixgGH6CbNyJnWry9Lvf:xAUOQnTNMpY+t50ejtHVIVcxgGbAWir

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
386ae2a6d0a1a032196c298b7bd8df3a_JaffaCakes118

Files

386ae2a6d0a1a032196c298b7bd8df3a_JaffaCakes118
.exe windows:5 windows x64 arch:x64

92f694988deed85a7cb067c901f32a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xcpad
Size: - Virtual size: 219.0MB

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ