05e1b15fc8786b9f37cbf3b93a4f7bc9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

05e1b15fc8786b9f37cbf3b93a4f7bc9_JaffaCakes118
Size

2.0MB
MD5

05e1b15fc8786b9f37cbf3b93a4f7bc9
SHA1

aa0a0c33f00da0cef851b7450b0b2e9116c8b961
SHA256

8e74045a286c2afc294425df00a2af73d5b7a6fe8eee78c15caf3a4ca26d2796
SHA512

8d7bc0764ade1d56eeea47290c03c7f8d2e2ee8d6ddda2b6135200d4e9d696e31531d511c044414f061a7da2e4b46f472c195ce21d40c358ca806366a4451b9e
SSDEEP

49152:QJgEjCCgdV/GqyIc4DcwFHTpoxx8vDhEd:UC/J9VlTc8vN8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05e1b15fc8786b9f37cbf3b93a4f7bc9_JaffaCakes118

Files

05e1b15fc8786b9f37cbf3b93a4f7bc9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5b002c42510b2f2a73b35f4d2e728335

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Programmieren\Crew Aholic Releases\Aholic Binder v1.0\Aholic Stub\Release\Aholic Stub.pdb

Imports

kernel32

lstrcatA
GetTempPathA
GetModuleFileNameA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime

user32

wsprintfA

shell32

ShellExecuteA

msvcp71

??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ

msvcr71

fopen
__security_error_handler
_except_handler3
_c_exit
_exit
_XcptFilter
_ismbblead
fseek
exit
_acmdln
fread
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
fwrite
_amsg_exit
fclose
_cexit

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ