a70be7a62fa4f0fb5320d05edd0f65c3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a70be7a62fa4f0fb5320d05edd0f65c3_JaffaCakes118
Size

352KB
MD5

a70be7a62fa4f0fb5320d05edd0f65c3
SHA1

89df052f99878212583df323b4f92cf270ed90bc
SHA256

031a620f158c4e909d77816f95b9bdada4d94bc3db3bb90180f3b5b297429806
SHA512

7b1ea0dfed35080f850fad2896db6ac9800201e970a6d3575dae414e3b290a072cb2da1a4616b98fbaa7dfbadfb93b4df5f168ffc85107ea41371b06ac1c4dcc
SSDEEP

6144:vOJVI1suR3ndB3LuoM6017w2yG3uIsRbb18A5vv9M8MnGhxCDiW04w:MVIOuFndBSoMrpw2VuIsRPR9EnGhUDF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a70be7a62fa4f0fb5320d05edd0f65c3_JaffaCakes118

Files

a70be7a62fa4f0fb5320d05edd0f65c3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1a3827f0751654cb5204c3d8833ef2ca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
GetProcAddress
DeleteCriticalSection
QueryPerformanceCounter
TlsSetValue
LocalAlloc
FreeLibrary
TlsFree
HeapFree
VirtualAlloc
CreateFileA
CreateThread
GetTickCount
GetVersion
ExitProcess
lstrlenA
GetStartupInfoA
GetModuleHandleA

msvcrt

exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_strcmpi

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ