a3fa3573b90e404ebfe3b6639349de6b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a3fa3573b90e404ebfe3b6639349de6b_JaffaCakes118
Size

461KB
MD5

a3fa3573b90e404ebfe3b6639349de6b
SHA1

edae6d88c04e715b635d83dffd1b0f5a3043e309
SHA256

1057c33c227df33d43ce5336760b0bf1cbd26917c8baf1104347467179fd6c33
SHA512

695ec56d873976e2de187253078e15f98257ca07fc9dba97817831ee7dd9f04b9c3389ba5666229b9bf28ff77cb11f3f9167bd05c303810739195a61073f6f5e
SSDEEP

6144:RcRUqYCF7Nuu1JbQxCos/3QRsjulhsJhbCGz:i3FZuaJbeu/3/6lKJhbZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3fa3573b90e404ebfe3b6639349de6b_JaffaCakes118

Files

a3fa3573b90e404ebfe3b6639349de6b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc60a920495dd603b6329f9f82fb28de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Acro_root_apms\build\Release-results\info\template.pdb

Imports

kernel32

GetModuleFileNameW
GetProcAddress
LoadLibraryW
HeapFree
GetFileAttributesW
HeapAlloc
GetProcessHeap
GetCommandLineW
SetStdHandle
ExitProcess
CreateFileW
GetModuleHandleW

shell32

CommandLineToArgvW

msi

ord173
ord205

user32

MessageBoxW

shlwapi

AssocQueryStringW
StrCmpW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xbqcfxq
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 347KB - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE