61aca3a7b861b4aa47017767a579772b_JaffaCakes118 | Triage

Sharing

General

Target

61aca3a7b861b4aa47017767a579772b_JaffaCakes118
Size

270KB
MD5

61aca3a7b861b4aa47017767a579772b
SHA1

f4de959a5b702b97c3933659564bb9409b89a7fc
SHA256

4896bd3411ed41923b4ba55f0f11dde319d9ebf483c12ed16a6f60a623eedab1
SHA512

0b9a3e930ec3eb2362d145b0eee02231a1463a0f7fdbf8017d43c00826c0c2e7e0a2fcedae68b2695588fe02f65c8aa1b05bb336fb494d5fcbb49671fe5d4686
SSDEEP

6144:vzJktbRzNFWbcePCbXLGCYu1no+4y8ywn:1ARNUbc1rivu1r3E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61aca3a7b861b4aa47017767a579772b_JaffaCakes118

Files

61aca3a7b861b4aa47017767a579772b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6ba120642a493da654ee8f53ed845424

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Download\test123\3434\Release\3434.pdb

Imports

kernel32

GetCurrentThreadId
GetModuleHandleA
CloseHandle
ReadFile
CreateFileA
LocalAlloc
GetSystemTime
GetModuleFileNameA
GetProcAddress
LoadLibraryA

user32

GetKeyboardLayout

Sections

.text
Size: 4KB - Virtual size: 669B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ