ef0cb11e207e85934c655f17c4955961_JaffaCakes118 | Triage

Sharing

General

Target

ef0cb11e207e85934c655f17c4955961_JaffaCakes118
Size

46KB
MD5

ef0cb11e207e85934c655f17c4955961
SHA1

4af042c1b95f8d2c6e01b804f99ea578814f6bab
SHA256

4885962e650bd0476a3057d0f9b2bebf7538b9cbbb892b6ccae2fb45790a427c
SHA512

c48288835e6f7f0fd6c9d3b7cf55d3572da1cbfacf978c63bec8d61d33ba1e778c540ad8d05a99a55425db09db36c9fa6e28d5c21087aa1b0114d0069890a069
SSDEEP

768:fqh7/ClyJhD0wgIpinmd640YIgvqsZYJ8LADtDpE/6YErEWxRjQ3uYBeKMkiDFCd:2/Cligln00YLBYJ8LADt2/HEr5jH3DUd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef0cb11e207e85934c655f17c4955961_JaffaCakes118

Files

ef0cb11e207e85934c655f17c4955961_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f6b05a68eb27c7b7a6b305bd2986420c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

atl

AtlMarshalPtrInProc

ntdll

NtAddAtom

kernel32

DisableThreadLibraryCalls
SetLastError
VirtualAlloc
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
GetTickCount
GetProcAddress
QueryPerformanceCounter

Sections

.textbss
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ