a47d47f56261d30bc37a5fd161425018_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a47d47f56261d30bc37a5fd161425018_JaffaCakes118
Size

124KB
MD5

a47d47f56261d30bc37a5fd161425018
SHA1

53e16263ba18969557da3b8a43070643439df234
SHA256

82ef81517e3bb72e30bba34b92e65db32e81462406d2b1d4da390f0a9c35b109
SHA512

fc64eec04c99f2e9af70e972d98e660b44c6352f311d1ad8c01ee9d0b2af69ca0509b0dbf3754845a875b3b4aa78c88f4c1d2bf44b9e15608b9445c7c6833c15
SSDEEP

3072:t9QUUUoY0yelhvPuVJIXCTTpu2MvX4NXkbVWi:t9QUJo/lhvPgIGTof1f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a47d47f56261d30bc37a5fd161425018_JaffaCakes118

Files

a47d47f56261d30bc37a5fd161425018_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0e2c1d4c72aa2252d14a9fdf25e1cd58

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3

kernel32

WaitForSingleObject
CloseHandle
WriteFile
CreateFileA
CreateThread
lstrcatA
GetLastError
CreateMutexA
lstrcmpA
lstrcpyA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetModuleHandleA
IsDebuggerPresent
GetCurrentProcess
lstrcmpiA
HeapAlloc
HeapFree
GetEnvironmentVariableA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
lstrlenA
GetProcAddress

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ