a506e8e139abdc89561e283c166682c0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a506e8e139abdc89561e283c166682c0_JaffaCakes118
Size

348KB
MD5

a506e8e139abdc89561e283c166682c0
SHA1

6986045ab8d0e5190c7e6c002bc5028099bf120d
SHA256

01eaee7bb314b16c7d1a4fd1672358fb6614f939eaaf3a4cf0e111dae096ccaf
SHA512

0c3742deb1be453f5b8cd35b1afef48e26537d0630b10240961d2d119520a6a6c1cbc5f38ee1a258025370fd00512e5c768bf00034f25ebf866611d7027638fc
SSDEEP

6144:xNxL4h1dgkWzaaRq45M4Yv2JsP6InIz6iM6dTwJyzunbt:xNFTJaaRq45H/sSInI2mwUz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a506e8e139abdc89561e283c166682c0_JaffaCakes118

Files

a506e8e139abdc89561e283c166682c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2571c5c1d3a25539d7b4dced616976ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\!CryptorV3\cryptor\wsmt2\Release\WSMT.pdb

Imports

kernel32

GetLocalTime
GetLastError
GetModuleHandleA
VirtualProtectEx
GetProcAddress

advapi32

CryptExportKey
ConvertSidToStringSidW
DeleteAce
CreateWellKnownSid
CryptGenKey
CryptCreateHash
CryptDeriveKey

avifil32

CreateEditableStream

winmm

midiInClose

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 657B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 685KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ