471a35a16c6818c75e3b28815c6fae24_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

471a35a16c6818c75e3b28815c6fae24_JaffaCakes118
Size

49KB
MD5

471a35a16c6818c75e3b28815c6fae24
SHA1

061dd6980e65f1d51ab9dcf9da549dc08bec1bd0
SHA256

f247b3420db6dbd9761c958b8ea2be830eaec03c951b24dd92a5d9f87e83d533
SHA512

2858345f98acbf457ac37b1782066923ff06ec0eacc34a817cffa07666676afff9d85f2dc11d9d2e79b233db48201c8b3bb8e766d14082e6868aeecc8e1a5615
SSDEEP

768:7dCmLgpJlvxriU2D5HFd96K9P+HUrnA2AaJfTxkENkpcefKtL:pCzpPkU0ldJmR2XJ7xkENkBfKB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
471a35a16c6818c75e3b28815c6fae24_JaffaCakes118

Files

471a35a16c6818c75e3b28815c6fae24_JaffaCakes118
.exe windows:1 windows x86 arch:x86

cb29fa181ca75eb8dbdbfc058956659b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FindResourceA
GetModuleHandleA
GetProcAddress
GetTickCount
IsDebuggerPresent
LoadLibraryA
LoadResource
LockResource
SizeofResource
UnmapViewOfFile
VirtualAlloc
VirtualFree

advapi32

CryptAcquireContextA
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptHashData

comctl32

InitCommonControlsEx

Sections

.import
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ