1ae34a60e96c7f576f5beda9a7f1d108_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ae34a60e96c7f576f5beda9a7f1d108_JaffaCakes118
Size

629KB
MD5

1ae34a60e96c7f576f5beda9a7f1d108
SHA1

3cd6665aedee43a71e962ac2ca753979b020cea4
SHA256

2152f850baa0f5e57950471fad799db10f7cceb5f47e74c47d88ce7071e5a41d
SHA512

5a37b68e12c16255a8900949302c55674516827150791c233f38165ceac6bf63252dfc21d8e2d2f6f313ba0faeb67e4160f45f43916ef26ac9e57967a2ae67d5
SSDEEP

12288:IkNOge9gAX/xiufvUOfKCPd4D43J/8WrbLvCkReq3I9oei6M037bZOFWhT:I4ctvximUNe/8WrbLv0sI9oexV3/AC

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
sample	aspack_v212_v242

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ae34a60e96c7f576f5beda9a7f1d108_JaffaCakes118

Files

1ae34a60e96c7f576f5beda9a7f1d108_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dae2264e721d7c66f7fa35e864d11aba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA

Sections

.Kaos2
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kaos12
Size: 626KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xiaohui
Size: 40B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xiaohui
Size: 40B - Virtual size: 40B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ