64239d1a51fd50ec39bfb3fa79ef10cb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

64239d1a51fd50ec39bfb3fa79ef10cb_JaffaCakes118
Size

629KB
MD5

64239d1a51fd50ec39bfb3fa79ef10cb
SHA1

07f93761276c5880096778b74aa53ca9d04d4bab
SHA256

af6ebf5adfa6b02e8bd1640eb74f9204c632289774a2c091de5fe691fe20b256
SHA512

615a9e1762462f19ed70b95a00a1ee00ab17333a642fbe100a07a9dbaa61574bcaedc561374a56f71a1c642ba22fc1651440ab9e09ac576bdaeba841b055a11d
SSDEEP

12288:B1eMpPq+ABlW3XneDckK/77cMOyst1/ibIc/X4gx1RZ:Te5C33D7vMcf4MF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/E-0961101675425X8.com

Files

64239d1a51fd50ec39bfb3fa79ef10cb_JaffaCakes118
.zip
E-0961101675425X8.com
.exe windows:5 windows x86 arch:x86

1ea57984633d404729d7b4c04a05551a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rsaenh

CPDecrypt
CPEncrypt
CPCreateHash
CPDeriveKey

kernel32

GetCurrentThreadId
LoadLibraryExW
WriteConsoleA
GetShortPathNameW
CloseHandle
HeapReAlloc
VirtualAlloc
OpenFileMappingW
CreateSemaphoreA
LoadLibraryA
CreateThread
OpenMutexW
lstrcmpi
FindClose

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 660KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ