aaf0e80d1ffa677e1f0db9526c32874a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aaf0e80d1ffa677e1f0db9526c32874a_JaffaCakes118
Size

259KB
MD5

aaf0e80d1ffa677e1f0db9526c32874a
SHA1

8e51e8d57217fa2ebad1d427a1c8e8a77e20adc7
SHA256

12b4ecfc8329ee4f4ee99871914a184c14f33a702bb7963354cb961bc82c676e
SHA512

f08f7dc56efea62876327a90ca4c18c0efbc88ef5094b5643fbf7dabf939f0accc335abf7e2d6d6694846504dbc38947688cdaf61491dd5eb0a1e4b39dfd282b
SSDEEP

6144:LFNjRLMUfKdZN+hgrujaiFYO8qF9MtFVFjEO1:jZVyZAirujJY8StBjF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaf0e80d1ffa677e1f0db9526c32874a_JaffaCakes118

Files

aaf0e80d1ffa677e1f0db9526c32874a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4734b1ec93da5689fdfe3f845e91ef9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

fkit.pdb

Imports

kernel32

HeapAlloc
HeapReAlloc
HeapFree
VirtualAlloc
EncodePointer
SetEnvironmentVariableA
FlushInstructionCache
GetProcessHeap
UnhandledExceptionFilter
ExitProcess
ReadProcessMemory
GetSystemInfo
GetCurrentProcess
GetProcAddress
Sleep
GetModuleHandleA
TerminateProcess
RtlUnwind
SetUnhandledExceptionFilter

advapi32

CryptHashData
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptAcquireContextW
CryptGetHashParam

msvcrt

strlen
memset

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bound2
Size: 512B - Virtual size: 338B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ