8acd3478da727fec5503552d0fc83a4c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8acd3478da727fec5503552d0fc83a4c_JaffaCakes118
Size

99KB
MD5

8acd3478da727fec5503552d0fc83a4c
SHA1

d238b7f62a4543af21df18fce4e5df9fe2c7d8d7
SHA256

c0a0172a09984b7ddce0a7d093d87ba574fab851527b14b9b2c3434f6ba353e6
SHA512

bed62201657078060b957a3006fe325527f454fe183bcde2ed3e87e20f88859bfe03d889cbaa2202e2f9d5930eaf9bde7f26584bf27433145c2abcbb7f07a5ce
SSDEEP

3072:FcU8tjPuvj+VUKtC4/+tC3Kpy9IHq2+TWvVS6+:FAt/o2KYwwl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8acd3478da727fec5503552d0fc83a4c_JaffaCakes118

Files

8acd3478da727fec5503552d0fc83a4c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5ca7710df33f99c7de5357a36d0da989

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtFsControlFile
NtCreateThread
ZwFlushVirtualMemory
ZwDeleteKey
NtFlushBuffersFile
NtOpenEventPair
NtGetContextThread

kernel32

WritePrivateProfileStringA
FindNextFileA
GetPrivateProfileStructA
InterlockedExchangeAdd
ReleaseSemaphore
HeapAlloc
DeleteCriticalSection
RaiseException
FindClose
GlobalAddAtomW
GetProcessHeap
SetLastError
CreateDirectoryW
WaitForMultipleObjectsEx
GetThreadPriority
GetSystemDirectoryW
FindNextFileW
GetACP
CloseHandle
LocalAlloc
GetTempFileNameW
Sleep
GetCurrentProcessId
VirtualProtect
GetProcAddress
GlobalUnlock
GetCurrentThread
GetLongPathNameW
GetStdHandle
GetLogicalDrives
CopyFileW
GetStringTypeExW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ