a3cdec8d6068697a0cd48271947990e1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a3cdec8d6068697a0cd48271947990e1_JaffaCakes118
Size

364KB
MD5

a3cdec8d6068697a0cd48271947990e1
SHA1

b8ee7cdb91341e0c72f53350ad60664a250afd60
SHA256

3a548c03039cbf684556cd31641a34dc9b07f0df0a655fa3e479f3b740172ac1
SHA512

bc818fcf930d73e8d8fa881c4410e78b584ba0ac77607a37ed31ba154564e21f9a12fa36ac5f9dded0ace7bd57e40bee8e3a3332736c3cbf76c33343d14909f6
SSDEEP

6144:D8UDBY+1x0zpquvuBz7qb9mkpwsmOSCscSSsUoHPTK8ToWcmWzuygeOHWAfm:D86n0zpquUqRmkismOSY6Fvt0jgdHW7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3cdec8d6068697a0cd48271947990e1_JaffaCakes118

Files

a3cdec8d6068697a0cd48271947990e1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2717a120f3532759192746b08a75beea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
CreateFileA
WriteFile
GetEnvironmentVariableW

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 288KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE