6a48d8bc4fbda20137ee0d17737429f1_JaffaCakes118 | Triage

Sharing

General

Target

6a48d8bc4fbda20137ee0d17737429f1_JaffaCakes118
Size

308KB
MD5

6a48d8bc4fbda20137ee0d17737429f1
SHA1

18b0d6a666dee642f49846b6f1fd37a4d395bea7
SHA256

286d147effd0d451390cf3fa78d853556c823051af50a01e8b7f59892f474774
SHA512

92ff63dd2f21bcc0ffb6d9a9070fcfcc91b62994f824285ffeed2cf16ba10e609269a68cf311126805fce61c9478fba5091eea2063761c5aaf65fc7fd71dde63
SSDEEP

6144:fQ7mp4uHU2nkuGnN579XajyxBrCCHYvKG2zdBaHoom3t0OEejmDUY:fsSRnkJN579q2P3G2zdA/ejmDU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a48d8bc4fbda20137ee0d17737429f1_JaffaCakes118

Files

6a48d8bc4fbda20137ee0d17737429f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3c371a4d1a9feb8ef251814704f0a28f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
TerminateThread
GetLastError
CloseHandle
VirtualFree
GetFileSize
GetProcAddress
Sleep
HeapFree
CreateFileA
VirtualAlloc
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
HeapReAlloc
HeapAlloc

ole32

CoUninitialize

netapi32

NetDfsRemoveFtRootForced

avifil32

AVISaveOptionsFree

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 508KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ