6478f7a5492e9996ed8e2ffef5b0e6af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6478f7a5492e9996ed8e2ffef5b0e6af_JaffaCakes118
Size

332KB
MD5

6478f7a5492e9996ed8e2ffef5b0e6af
SHA1

da1eb0562a864f4dcb30ae70be54c8a631f12850
SHA256

1329ee009f571afd30b2de6a3a63c4ec23cb25fee9afc3d6862ff267a9026a1f
SHA512

2f2a862027c715c11e60d99b07532019bcb8bd4b3b7b6ca5861a9c2033782357eec8116566a7f12476c455d9e163c0260e879ab5fc34b32144283a901cc67433
SSDEEP

6144:uC5hgeCgpm5ySyNnRAy7roEV5hJTws9CFkz8lgYuaJNI7dPZwDEHUxHJl0BC:j5hbCgp4MRAUsEzTws4F68lyRdB/UFv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6478f7a5492e9996ed8e2ffef5b0e6af_JaffaCakes118

Files

6478f7a5492e9996ed8e2ffef5b0e6af_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a8c5fe4c4639e156f0c3d3e317c9cfd4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetExitCodeProcess
GetThreadLocale
GetUserDefaultLCID
CreateFileA
GetFileSize
WriteFile
OpenEventA
CreateNamedPipeA
DuplicateHandle
FreeLibrary
GetEnvironmentVariableA

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 280KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE