4fe26de30b6643be4e475e09eea88fd3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4fe26de30b6643be4e475e09eea88fd3_JaffaCakes118
Size

629KB
MD5

4fe26de30b6643be4e475e09eea88fd3
SHA1

20fa3e0bfeb5b0be2135f759e82c62a32f9168c5
SHA256

852bddbef59c7ac98f1059a0401652fd6396eedbdbc9beed1e3a0a8704dca939
SHA512

3ffe455b9211863b9f989ca745b47f4bb01d0a80c94dc09b70cfa21d6518870990080428b3d0e2743e63eb1faeca1b6b96ff8a7ccf580bd59c5d2bb94af9adf4
SSDEEP

12288:3s4HF0WaNmUnhNPJSv8ZoE0H7kjwgJ4/PpBHH9XTKnN+6SF0o3KfqmRi:3s4p4PJSUkIjwK43DdXen86S1azs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/B.872172-90255492A5.com

Files

4fe26de30b6643be4e475e09eea88fd3_JaffaCakes118
.zip
B.872172-90255492A5.com
.exe windows:5 windows x86 arch:x86

3f612a85b383fc846fb2c4f939b907f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rsaenh

CPDecrypt
CPEncrypt
CPCreateHash
CPDeriveKey

kernel32

GetCurrentThreadId
LoadLibraryExW
WriteConsoleW
GetShortPathNameW
CloseHandle
HeapReAlloc
VirtualAlloc
OpenFileMappingW
CreateSemaphoreA
LoadLibraryA
CreateThread
OpenMutexW
lstrcmpi
FindClose

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.data
Size: 656KB - Virtual size: 655KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ