ac7ca94f0594265dfd64ca4912997452_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac7ca94f0594265dfd64ca4912997452_JaffaCakes118
Size

317KB
MD5

ac7ca94f0594265dfd64ca4912997452
SHA1

639e764f51dbf4cce8bf0211d543b57755a3abbf
SHA256

4d3b414db143c35d2b6bd79e3072e6ab695bcfe9b79bc029adbdfe55042a17b8
SHA512

2d5d2c2f56d4a5d49ba8bde7e416a6c32265cd160530c2fbefcee66d2c070ec63c1dd7e9865d6f397e064a522f667b013bd279cf4760af3e3b8a60926d738df7
SSDEEP

6144:ymEVx9GBGHl+L+tVy6SnuT6+3A23uKIa4Le7c/HWZ+xG5BbpvhuT:1EVT9fnSWTVIP2Z+xUP+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac7ca94f0594265dfd64ca4912997452_JaffaCakes118

Files

ac7ca94f0594265dfd64ca4912997452_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a379f2a908a29608c4df092ef021ce8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
TlsGetValue
ResetEvent
GetProcAddress
VirtualProtect
ExitProcess
SetEvent
IsValidLocale

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ