efc70002c45727449e0c8994efa8a324_JaffaCakes118 | Triage

Sharing

General

Target

efc70002c45727449e0c8994efa8a324_JaffaCakes118
Size

96KB
MD5

efc70002c45727449e0c8994efa8a324
SHA1

9b3e232c61507da4bbc06758dbe004148927b411
SHA256

f1f437c4de9cfd97d466288b31a6930d5d5db742c59d9689e970f14cd120eef8
SHA512

d21dd57b52b6dc10747da7d42290d93bfe3f507a301c9e797b76fc0e09c1ac824c0b4538a7c90322e767e6e163b31527f81d47a467cc35279939c3f86248a978
SSDEEP

1536:teqaCMQ9PO3U3n+wWRKceSbvPgIDoxRtKFYIGm/hoVlhYbaoQ+u0Dj/Szs8VVLTn:PaC5ZsU3WocvoI0xGlj/holYmoQMP/03

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efc70002c45727449e0c8994efa8a324_JaffaCakes118

Files

efc70002c45727449e0c8994efa8a324_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b0f0c04b974aa380150028068c87f294

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
CreateEventA
GetCurrentThreadId
GetCurrentProcess
CreateMutexA
GetVersionExA
GetCurrentProcessId
GetComputerNameA
ExitProcess
SleepEx
VirtualAlloc
GetStdHandle
GetCurrentDirectoryA
LocalAlloc
GetSystemDirectoryA
LocalFree
GetWindowsDirectoryA

advapi32

GetUserNameA

user32

GetSystemMetrics
GetForegroundWindow
GetActiveWindow

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ