037a451592aa783248a850714c3c0fad_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

037a451592aa783248a850714c3c0fad_JaffaCakes118
Size

313KB
MD5

037a451592aa783248a850714c3c0fad
SHA1

c7363d5ef98c9b7294b23fa91c963abfb35f8c61
SHA256

ea61d4ebfcbef8e0cfbab7fa621f8e9a98f1ec713ca31335d81411e23b062e79
SHA512

20c2e34951749d226af7633f2a0ac3aa657eb66c5a42af270864a8600fc64a046eb4249ec6542f6ebd16d61cfa3cb311b28ec20892d1321703c2c0ee6fcde1d8
SSDEEP

6144:JdGe0Q3cvHRdFYMUeqW5x2ZA9Zh6v9SERaumoVOzELDHt3D/ox/EP+bIT2Gz:LYQSdCMFqWz2O9Zh6v9SSzmokALDNTo3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
037a451592aa783248a850714c3c0fad_JaffaCakes118

Files

037a451592aa783248a850714c3c0fad_JaffaCakes118
.exe windows:4 windows x86 arch:x86

10270f1a7e66920800278de1ee11fc6b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteFileW
GetCommandLineA
GetFullPathNameW
VirtualProtectEx
VirtualFree
GetCurrentThreadId
CreateEventW
FormatMessageA
lstrcpynW
GetModuleHandleA
GetModuleFileNameW
TlsFree
GetStringTypeW
TlsGetValue
SetCurrentDirectoryW
WriteConsoleA
GetPrivateProfileIntA
lstrlenA
SetThreadPriority

wmadmoe

DllGetClassObject
DllUnregisterServer
DllCanUnloadNow
DllRegisterServer

Sections

.text
Size: 14KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.ndata
Size: 290KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ