a3a8c9becf7a37dd99e9c25b45e86d58_JaffaCakes118 | Triage

Sharing

General

Target

a3a8c9becf7a37dd99e9c25b45e86d58_JaffaCakes118
Size

60KB
MD5

a3a8c9becf7a37dd99e9c25b45e86d58
SHA1

85e24dcd310c1ddb23f35f3c011506df6f4e9586
SHA256

4e85e19c7aa61320f3c0ab3383cbdb37d752c80c0ae34d656483230c30e41f54
SHA512

55cb53100b7432eee5f1b95321e107e3012f7f101d221ea3201a4d0101977681e24f2a5973a4a1fa0067e803ace6d022103f34769ca5a5b91cd47383d0c134f3
SSDEEP

768:RfeC+PLlSyP9GYr+vO4xsq9Jy8uCnVBnbidl0jowo4j3D:ZerJSyP9GYX4i8g89Vw8jow1j3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3a8c9becf7a37dd99e9c25b45e86d58_JaffaCakes118

Files

a3a8c9becf7a37dd99e9c25b45e86d58_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2484ebd02311c8dc64828f192139e5a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\odin\miniloader\build\release\obj\src\main\miniloader-patchdate-stub.pdb

Imports

kernel32

GetStartupInfoW
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FindFirstFileW
FindClose
FreeLibrary
LoadLibraryW
GetProcAddress
GetLocalTime
WriteFile
SetFilePointer
ExpandEnvironmentStringsW
GetCurrentProcess
CreateFileW
DeviceIoControl
CloseHandle
SetErrorMode
GetVolumeInformationW
GetDiskFreeSpaceW
GetCommandLineW
GetDriveTypeW
SetVolumeLabelW
GetLastError
GetEnvironmentVariableW
Sleep
HeapAlloc
GetProcessHeap
ExitThread
MoveFileWithProgressA
SetLastError
HeapFree
CreateThread
ExitProcess

user32

EnableWindow
SendMessageW
PostMessageW

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ