ff084f0b1dd8b051952eced5422f2114_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff084f0b1dd8b051952eced5422f2114_JaffaCakes118
Size

631KB
MD5

ff084f0b1dd8b051952eced5422f2114
SHA1

06a480c88d87d1e4205bd31a55328f67ce1bfa37
SHA256

d08273aa093cdb030239937cb44b150ddc21d1541265dc520b4ff0d028e24866
SHA512

2f4c89533585460ded05880390e408d23703c7fc2a6b60f0b147d549cef1de0573c83d64fdce7eb56261869a88d9251d201ccc465c08213e785ecf88998d97ab
SSDEEP

12288:rIVtCd5g6JdQ551QKPQE/MmOtJZmS+xqQYZLrR5JvyN+DvuCJqGA:rInCd5PJdaoKoEuIxWL9E8vuCJfA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Verrechnung-395991162369835.com

Files

ff084f0b1dd8b051952eced5422f2114_JaffaCakes118
.zip
Verrechnung-395991162369835.com
.exe windows:5 windows x86 arch:x86

bc3388b6accbccc13b029d5f0877fdd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow
GetPropA
LoadIconA
CharToOemW
LoadCursorW
MessageBoxA
PostMessageW
GetClassLongW
IsCharUpperA
PeekMessageA
GetDlgItemTextW
LoadBitmapA

kernel32

ReadFile
GetVersionExA
GetTickCount
LoadLibraryExW
GetFileAttributesW
CreateProcessA
CloseHandle
LoadLibraryA
HeapAlloc
VirtualAlloc
OpenFileMappingW
FileTimeToSystemTime
CreateMailslotA
GetACP
FindResourceExA
OpenSemaphoreA
SetCurrentDirectoryW
WriteConsoleW
CopyFileW

odbctrac

TraceSQLFetch
TraceSQLCancel
TraceSQLConnect

Sections

.text
Size: 648KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ