f5413494649d24a8b68987e0edd03131_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5413494649d24a8b68987e0edd03131_JaffaCakes118
Size

2.0MB
MD5

f5413494649d24a8b68987e0edd03131
SHA1

584d74ac719fe20cbd629f83a86774d7050542b4
SHA256

3bff5348ce6f37b459adcd22ac800ed31aa0f92c9829f33a819608e375cd3dd6
SHA512

8d418d347407a62bc6c52b3a296fcf66256950cdef19b2968627dde786fe8e66d5e64ffab3db7d9e77cb9977b456461c8313048a1d99fcd9f56cc3fdbe95687d
SSDEEP

24576:qiuHGCndTVmdO4imTIWY1+001fFx1FhYzpESuOZMbTlsWMoXtkQ:MGCnd+PimTItv0jx1FhYzpfuOMbTdXr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5413494649d24a8b68987e0edd03131_JaffaCakes118

Files

f5413494649d24a8b68987e0edd03131_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d590367c7197c29e8b5b0199830535e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
GetProcessHeap
VirtualAlloc
DeleteFileA
GetConsoleTitleA
InitializeCriticalSection
GetSystemDirectoryA
SetFileAttributesA
FindFirstFileExW
WriteConsoleOutputA
GetFileSize
GetLogicalDriveStringsA
GetProcessTimes
DeleteCriticalSection
TryEnterCriticalSection
GetPrivateProfileStringA
GetThreadPriorityBoost
EnterCriticalSection
_hread
DeleteAtom

authz

AuthzAddSidsToContext

Sections

.text
Size: 747KB - Virtual size: 746KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 431KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 98KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ