068b4aef730210460d24ae0490b8006c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

068b4aef730210460d24ae0490b8006c_JaffaCakes118
Size

46KB
MD5

068b4aef730210460d24ae0490b8006c
SHA1

4cd49bae9ba2f42c2149c2ff14c5905227c15d6b
SHA256

5bec128209ad6be65fdb39c1a0e2ba795f9879461b2a085e3204f5389083cfbe
SHA512

b3830a192d70e295af386044f9d0dcd8df33385ded988e1bb37c7c69ae9270b988f38101cee41c289e37cbad20e02e4e5d0f42fd93336f0c8a8360d28c2af41e
SSDEEP

768:Frq01BmfRsNOCKQbBGg6Fsscs9fnghQDgwua7xyZfnA6iyIy0gmTy9bT9:FrqdRoBdD6Z51ng8gwOZ9iyIy0gme

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
068b4aef730210460d24ae0490b8006c_JaffaCakes118

Files

068b4aef730210460d24ae0490b8006c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e9632d35f1be92399346040a70a7dfba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleA
GetSystemTimeAsFileTime
GetProcAddress
FreeLibrary
SetLastError
LoadLibraryW
VirtualAlloc
DisableThreadLibraryCalls

ntdll

NtAddAtom

atl

AtlMarshalPtrInProc

Sections

.textbss
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ