2a3776a7a88a29d48a4daaa3e70506f9_JaffaCakes118 | Triage

Sharing

General

Target

2a3776a7a88a29d48a4daaa3e70506f9_JaffaCakes118
Size

2.7MB
MD5

2a3776a7a88a29d48a4daaa3e70506f9
SHA1

c3e3afede30abbea38e64f9de9d0b66ac7d119aa
SHA256

3d999bffa41e873a221ecb76fb8b8b87888653326b8310b710af17578e6bb9f7
SHA512

e1bd8e83bfa27a1e82c251e92d010d6ee0d308118f699554eb94997141b3bb284703763a3cc66ecaff60b096d46535e304eaa65c340b4e4b404b77d8dadc2580
SSDEEP

49152:GjBeZACS4SNSFLKYkbWx1ySxHvlAeAedVVRJIpZVqyyYOmQ75kLCShMQ:EDCSBNSwS/yle1VVMpNC5kOSX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a3776a7a88a29d48a4daaa3e70506f9_JaffaCakes118

Files

2a3776a7a88a29d48a4daaa3e70506f9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

46084168b412e051097ae39c055c9320

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
ExitProcess
FormatMessageA
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 24KB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ