0a6e92902609758f5a99de2ab8c21d98_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a6e92902609758f5a99de2ab8c21d98_JaffaCakes118
Size

64KB
MD5

0a6e92902609758f5a99de2ab8c21d98
SHA1

a3853615373fe23e5fd83adcd8f0d9798b39fb08
SHA256

2ae6e2e248b2830cd07c55538b0bb8efa918dc75576adde44fb34efa4793166a
SHA512

cdb5ee26d023abcd193b48aeb39be1cc9d444eeac0c82e069b45bd6dbb91faa3592ec1c3ca949b67de0fe182cf70a1a29f9e5ce267c83e6f69592eafb0b5caeb
SSDEEP

1536:Etj92tC0verpm1zNV66BFtSqBIjt1xu+vI6Iv:EVJIntSqB6t10+Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a6e92902609758f5a99de2ab8c21d98_JaffaCakes118

Files

0a6e92902609758f5a99de2ab8c21d98_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e71c1632e0c3c318ce204a70daaf5ac7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
lstrlenA
WriteFile
GetProcAddress
LoadLibraryExA
CloseHandle
ExitProcess
GetComputerNameA
MoveFileExA
GetCurrentProcess
Sleep
CreateEventA
TerminateProcess
GetSystemDirectoryA
lstrcatA
lstrlenW
LoadLibraryA
OpenEventA
GetModuleFileNameA
lstrcatW
lstrcpyA

shlwapi

StrToIntA

imagehlp

CheckSumMappedFile

ole32

CLSIDFromString
StringFromCLSID

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 358B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ