302cce4c475a380021483f0dbaebd3cd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

302cce4c475a380021483f0dbaebd3cd_JaffaCakes118
Size

601KB
MD5

302cce4c475a380021483f0dbaebd3cd
SHA1

f3369b083c76fc809431ad81607572736773f823
SHA256

1d8075ce108e36d1cda6fd25be56c60c99afd42348c85c1078738c4a1259792e
SHA512

02377d1b67ccb6f785e9c24345e99e52fcb60b122794ec752168bbc1265d5b532a7029c915ccbfe1537b6ba12331ba44394570f1ba31ae8dae42a81c5f16661a
SSDEEP

12288:homHytf6BezSQDeLWZNjdCowkSNPiO+WEF/MRv:OffKLKNjdCowkVO+TM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
302cce4c475a380021483f0dbaebd3cd_JaffaCakes118

Files

302cce4c475a380021483f0dbaebd3cd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

070d723f09deab270e6f8534509d239e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Acro_root_ap\Main\build\win\results\Release\info\template.pdb

Imports

kernel32

GetProcAddress
LoadLibraryW
HeapAlloc
GetUserDefaultUILanguage
HeapFree
ExitProcess
GetCommandLineW
GetModuleHandleW
GetProcessHeap

shell32

CommandLineToArgvW

msi

ord205
ord173

user32

MessageBoxExW

shlwapi

StrCmpW

Sections

.text
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ