aa79f6c320f063698a8d73e4d3409251_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa79f6c320f063698a8d73e4d3409251_JaffaCakes118
Size

48KB
MD5

aa79f6c320f063698a8d73e4d3409251
SHA1

1e1f0c7a6a6972709fdd776cf76e35bbbe55366d
SHA256

4608619cf4399b52411b51c195de06d9d96c171bb53d9fa8045979322b6a1e8a
SHA512

a6c46d3e77543abaa649a17aa6b37b2bdfd03b4c1a18b7722f40d40f3818cab7baf50a0457f9a6137954aec8b7286d28094ef12e03d4e4919fb8f5bc5dd577ff
SSDEEP

768:8a3kLBIvuNoZzZ+mwtgKwVPqFPJEpens0zsy6O4km73s1p8hMyTh9++YWZRDrHGm:x0NoX+bCCFPJEgnHzx63GpOZ++Y2RDrD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa79f6c320f063698a8d73e4d3409251_JaffaCakes118

Files

aa79f6c320f063698a8d73e4d3409251_JaffaCakes118
.exe windows:4 windows x86 arch:x86

208ac55e0c54b73d1a1e8dd8395abe1d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
FreeConsole
HeapFree

ntdll

NtCreateFile
RtlNtStatusToDosError

activeds

FreeADsMem

crypt32

RegQueryValueExU

Sections

.textbss
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE