2b31c77ebff1e05a91376544e2508bcc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b31c77ebff1e05a91376544e2508bcc_JaffaCakes118
Size

267KB
MD5

2b31c77ebff1e05a91376544e2508bcc
SHA1

afa0432d48b6fc0278ec8e70479cd4b205d4134f
SHA256

7b4741f593ef99237ce21f4ff1eef6b60fbc84e2136d9bb594e9cce39f8875fa
SHA512

017e484493757b0760949d9254c9327eb9b9f7ed1a520bd2a34de8450e1579d188e450a399bf4ba20846fd5db7449c2070b7107ea9b07f349f14c266a4c8ecf4
SSDEEP

3072:3OVG/F8YZix9gf2gzxvL2fKKslnjIqsH4lG/F8YIMWYN74X3NvHC5rKGa7t9o:3QCGxQfzxvKfAlncqFlCPNcBkrY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b31c77ebff1e05a91376544e2508bcc_JaffaCakes118

Files

2b31c77ebff1e05a91376544e2508bcc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a6c96be1a2fe5ac582087f8e356f3def

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

outlook.pdb

Imports

outllib

RenInitInstance@12
FMessageLoop@12
RenExitInstance@0

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__getmainargs
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
__p__commode

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
VirtualProtect
GetStartupInfoA
GetModuleHandleA
GetTickCount

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 257KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE