629a6d1937350ffc1b6058e749d35214_JaffaCakes118 | Triage

Sharing

General

Target

629a6d1937350ffc1b6058e749d35214_JaffaCakes118
Size

307KB
MD5

629a6d1937350ffc1b6058e749d35214
SHA1

553c5619424ebeb8fa98d4ecb405b2eefcff5773
SHA256

4af834b5d3f53485fc3df66af0ccf87b7fdd63944023fde7fbe6120255e5aeb0
SHA512

dce235cd8906153f0db272e1e19c1f36da5d95c1229243fd67ad09ce9f34bb8389755cfa9cb1b85c8337156e2da9f160fc0088004b9cea0243af41bfefb6c7ce
SSDEEP

6144:Ytj4qBy6cqJuzYrB4YbDgEtOLTSqT4aQWeWwBGE47WvWT:Kj3GcBvoEtQTS5aQWKh4i+T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
629a6d1937350ffc1b6058e749d35214_JaffaCakes118

Files

629a6d1937350ffc1b6058e749d35214_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a8a9ff491a61520eac10acc5400f8699

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionA
WaitForMultipleObjects
GetDiskFreeSpaceA
GetPrivateProfileIntW
lstrcmpiA
CreateEventA
LoadLibraryExW
Sleep
HeapCreate
GetFileAttributesA
GetPriorityClass
GetDiskFreeSpaceA
InterlockedExchange
GetPrivateProfileIntW
CreateDirectoryA
SetFilePointer
LoadLibraryA
Sleep
GetExitCodeProcess
lstrcmpA
SetEnvironmentVariableW
Sleep
OpenMutexA

catsrv

OpenComponentLibraryTS
DllCanUnloadNow
CreateComponentLibraryTS
GetCatalogCRMClerk

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE