ef96dc82ea483e10864dc0cf2c717fea_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef96dc82ea483e10864dc0cf2c717fea_JaffaCakes118
Size

5.0MB
MD5

ef96dc82ea483e10864dc0cf2c717fea
SHA1

62be37effe5e5bb7a0cec4449d1b869faf7a496b
SHA256

4577ebef2f55851d29fd5c1d03ef22cddcc651e01bd99a7893c1cc0f0bbae201
SHA512

36752f10778a4ba632dffb518d34533f0f2fda1d228ca5c65b10859e84a9de6ca6ef2bc1a8dfd44337fbba6e60ea8c434752c1dcd5109f0327bb812c3a838041
SSDEEP

98304:lG6jiteMkxo7pkED6RELIVUx35THY7jOal8kZBvaXCynTc2ly1GpTp//1Fg:E6uteMkxo7pkED61VQJaamZBaXPY2N/Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef96dc82ea483e10864dc0cf2c717fea_JaffaCakes118

Files

ef96dc82ea483e10864dc0cf2c717fea_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d6e344391693b1651eb8a01b91202e13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\EITreleases\EIT-2.0\Distrib\free\build\ex_inst_toolkit\xinst_lzma\Release\xinst_lzma.pdb

Imports

comctl32

ord17

user32

MessageBoxA
wsprintfA

kernel32

FreeLibrary
LoadLibraryA
GetTempFileNameA
HeapAlloc
ExitProcess
GetModuleFileNameA
HeapFree
ReadFile
lstrcatA
CloseHandle
CreateFileA
GetTempPathA
GetProcessHeap
DeleteFileA
CreateDirectoryA
GetWindowsDirectoryA
GetStdHandle
lstrcmpA
GetLastError
GetProcAddress
WriteFile
GetCommandLineA
SetFilePointer
lstrlenA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ