a616b589a63c65571557c128e0c25525_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a616b589a63c65571557c128e0c25525_JaffaCakes118
Size

292KB
MD5

a616b589a63c65571557c128e0c25525
SHA1

f02e992499058572446230f09dfa7248ba3cb8ab
SHA256

bc085c1558e80157b499bba4fedb82cfaa40797102d5efb2de800c89a9c5cbeb
SHA512

6957e6efde93cd25ed0091c69086d62eab0135350197b71e07a4b1b3d342390743f2a4f1c6e17beeb8b1b71d344e2a55b77dd63751efbb919044f2684cf9cf00
SSDEEP

6144:1vCI077T5FojUiOHiORYw4hAhX72MPacxdUDgqBdbr/ftCaP:QxnT5FMUiOPYw5F2MPpxIgqBdP/ftCC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a616b589a63c65571557c128e0c25525_JaffaCakes118

Files

a616b589a63c65571557c128e0c25525_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a784af970ce24384f7fb6d282794ebab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
LoadLibraryA
GetStringTypeW
GlobalLock
GetCurrentThreadId
GetCommandLineA
FreeEnvironmentStringsW
HeapDestroy
TlsSetValue
QueryPerformanceCounter
VirtualFree
DeleteFileA
InitializeCriticalSection
GetConsoleOutputCP
TerminateProcess
DeleteCriticalSection
GetOEMCP
GetVersion
GetCommandLineW
GetLastError
GetModuleHandleW
GetUserDefaultLCID
GetCurrentProcess
GetModuleHandleA
GetSystemDefaultLangID
GetCurrentProcessId
GetUserDefaultLangID
GetTickCount
VirtualAlloc

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 272KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ