839c62a10efe98551442f9d3cb4e062c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

839c62a10efe98551442f9d3cb4e062c_JaffaCakes118
Size

348KB
MD5

839c62a10efe98551442f9d3cb4e062c
SHA1

a70d9509ce18c63b324b0372aa9bbb7fa835f470
SHA256

863f8e7138f396cf6a595c79e2bd64096a35d24dd9fafc93e883a5a2cda95b7e
SHA512

2b947a2dcf2e193cc4aa72038a60c18899832db3bed537f8ec166eed9611c3d6ddba79cfd3d6b7ef617cd9e4a7b94aaeaffb37d334f462d5bb7e99195674978e
SSDEEP

6144:8uGhzGnvlBCXx1XI6Az+QZgEEtsEsDE9HbK3NpXSWP2eEnm7X:dG2lBSxi+QhislDEhKdPOU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
839c62a10efe98551442f9d3cb4e062c_JaffaCakes118

Files

839c62a10efe98551442f9d3cb4e062c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2571c5c1d3a25539d7b4dced616976ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\!CryptorV3\cryptor\wsmt2\Release\WSMT.pdb

Imports

kernel32

GetLocalTime
GetLastError
GetModuleHandleA
VirtualProtectEx
GetProcAddress

advapi32

CryptExportKey
ConvertSidToStringSidW
DeleteAce
CreateWellKnownSid
CryptGenKey
CryptCreateHash
CryptDeriveKey

avifil32

CreateEditableStream

winmm

midiInClose

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 657B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 685KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ