ceea1a56c67e00fcc44817000cf7cca0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ceea1a56c67e00fcc44817000cf7cca0_JaffaCakes118
Size

123KB
MD5

ceea1a56c67e00fcc44817000cf7cca0
SHA1

493d7a5aa508970e51cef82e722b7f5c73e23ba8
SHA256

fea601e019cfa0ddfb0fa2bb3e2182652f08c207dc3b4d10b1c6407497b44742
SHA512

73a7e23920e8b3349fec07985312459ff0bfa4886b847504b2a08db7d539012665744ab6e31eab123ab2de2caa8520a204af52cf0184d596230e21698af9c63e
SSDEEP

1536:7FmNe999999b6m99999DM999tfoR3Ca3KxZHsjX0bMOeXrhkfQ3sGFSFQA18pEND:pO83CAKxC7WM9XrE0w1UENDR9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceea1a56c67e00fcc44817000cf7cca0_JaffaCakes118

Files

ceea1a56c67e00fcc44817000cf7cca0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e478acd6a4396e443266876ad7f39fb8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

o:\Programmieren\Codesoft Releases\_NEW BETATEST\Trojka_Crypter_2.0\chris611 Version\release\stub.pdb

Imports

kernel32

Process32First
lstrcpyA
GetModuleFileNameA
GetModuleHandleA
CreateToolhelp32Snapshot
lstrlenA
GetProcAddress
GetEnvironmentVariableA
GetShortPathNameA
LocalAlloc
LocalFree
CloseHandle
Process32Next
ReadFile
GetFileSize
CreateFileA
lstrcatA
GetTempPathA
LoadLibraryA
CreateProcessA
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Module32First
Module32Next
lstrcmpA
WriteFile
ExitProcess
VirtualQuery
GetVersionExA
RtlUnwind
IsDebuggerPresent

user32

wsprintfA
MessageBoxA

advapi32

RegCloseKey
RegOpenKeyExA
GetUserNameA
RegQueryValueExA

shell32

ShellExecuteA

shlwapi

PathFindFileNameA

Sections

.f0Gx
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ