3bcaf703435b0f0e4efd20cc091b2e88_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3bcaf703435b0f0e4efd20cc091b2e88_JaffaCakes118
Size

49KB
MD5

3bcaf703435b0f0e4efd20cc091b2e88
SHA1

756324048a39b0d20ebc18d662e6d0eeab22f0cf
SHA256

2be6c3ead44f10e22436e63f36ca569603781c8548ba5762401c42c79ff9685e
SHA512

b1ce12ba6da9e9f36a77fb64f2fa7e369f363de4de7447bdc8b6136c9fca162fa10e6f68a5f61bc435a7957814e32f8c7db192b1174c19f4bc19ec98acbe9dfa
SSDEEP

768:W4wJOoJXg2e4yREXG1jF0KvPb6VicTxgF2xCpm1oH6az16VJ+43vRqIJ/:twOoJX/e4s36VejhgxJn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bcaf703435b0f0e4efd20cc091b2e88_JaffaCakes118

Files

3bcaf703435b0f0e4efd20cc091b2e88_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1d7b36eb323d9a8f9b224ff72b2cf889

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dev\Cr4shCrypt\b4-crypted.pdb

Imports

kernel32

GetCurrentThread
GetVersionExA
GetSystemDirectoryA
GetCurrentProcess
CreateEventA
LocalFree
ExitProcess
GetWindowsDirectoryA
GetComputerNameA
VirtualAlloc
CreateMutexA
GetCurrentDirectoryA
GetCurrentThreadId
GetCurrentProcessId
LocalAlloc
SleepEx
GetStdHandle

advapi32

GetUserNameA

user32

GetForegroundWindow
GetSystemMetrics
GetActiveWindow

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ