efa640aa97ab0ab4b57969981b5b92a8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efa640aa97ab0ab4b57969981b5b92a8_JaffaCakes118
Size

70KB
MD5

efa640aa97ab0ab4b57969981b5b92a8
SHA1

d4406f07d361210f174bfcd817447d75685cd8b1
SHA256

77dae9d3455f27c67fc0788cc96c5480045c65a0c92c5bb821283c633043bc93
SHA512

88fafe9581c2af748150d9c1e9bf83c107eb43d71cd16cc0aecacb91d1957b38cad52c26dd88a15b01ea1018019ffe666d0a90bd4e47ec9c1ee63b7222fd483e
SSDEEP

1536:Fr12NN2O/x56tmqTLtCgqpzHDQM1sAqTc4w2FPoJw:lU/2S6tmRXNDQMCAY3wO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efa640aa97ab0ab4b57969981b5b92a8_JaffaCakes118

Files

efa640aa97ab0ab4b57969981b5b92a8_JaffaCakes118
.exe windows:3 windows x86 arch:x86

301f52d5cd74072bf50895609465f4f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
DisableThreadLibraryCalls
EnterCriticalSection
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
HeapFree
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
VirtualAlloc
lstrlenA

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ