3e34080c143b0a1107088df6a9fa35b4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e34080c143b0a1107088df6a9fa35b4_JaffaCakes118
Size

336KB
MD5

3e34080c143b0a1107088df6a9fa35b4
SHA1

6f7ea8b652db09f0e2005f82e6bd30a22f350a66
SHA256

a48ebbfac1e4640c796afff405af24ad00f53ffdf81e51236012edf922daec61
SHA512

050a7f355de32bba1be1f673a2d645f24d94be36d6ec6312d5d9db2a601359a9a3d7936b57238e275e283cf648f4c98bde64b2d83b60f624be36c930a3d76627
SSDEEP

6144:LWUMSUzyiZQITSU/vS8DKpi6JGYiTPHnplimppD6y+NssGEKndVI4qbg8:hHDiZBSU6picGYUHnpl2GGwdVI38

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e34080c143b0a1107088df6a9fa35b4_JaffaCakes118

Files

3e34080c143b0a1107088df6a9fa35b4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

be4b15e0ce2ddaf98f523d738f26ea40

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
IsValidLocale
IsSystemResumeAutomatic
CreateDirectoryA
CreateFileA
WriteFile
CloseHandle
DuplicateHandle
GetEnvironmentVariableA
GetConsoleCP

Sections

.pdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 280KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE