04c675d2fe667ec54221c4c8f6772f14_JaffaCakes118 | Triage

Sharing

General

Target

04c675d2fe667ec54221c4c8f6772f14_JaffaCakes118
Size

820KB
MD5

04c675d2fe667ec54221c4c8f6772f14
SHA1

50c029ebe05fa3065113329fed7a6ff74c962d23
SHA256

02223f4fbdd090acff203a4b35a3fafa223f3a1bfbd05f96bad5531b18136642
SHA512

ca0b64ba0f33de6ea2f402e3412e1f864df5dcae5301e7955ae86f55bea7674016ab50a62b1dee62f5b1ab19d66e2ec4b5b10d292aa895de29838083be745890
SSDEEP

24576:oMWLa127AI1OneaCi01TAcYbc6qMIuF5xdp6:p12InhD0nY5qpydp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04c675d2fe667ec54221c4c8f6772f14_JaffaCakes118

Files

04c675d2fe667ec54221c4c8f6772f14_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1d9a07a62a5ff5134302209293b373de

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetModuleHandleA
SetThreadPriority
SetCurrentDirectoryW
FormatMessageA
GetStringTypeW
TlsFree
GetFullPathNameW
CreateEventW
lstrlenW
GetModuleFileNameW
TlsGetValue
lstrcpynW
GetCurrentThreadId
WriteConsoleA
VirtualProtect
GetPrivateProfileIntA
GetCommandLineA
DeleteFileW

aaclient

LoadClientAdapter
OpenKeyReader
g_fnStartTransport
OpenKeyReaderWriter

Sections

.text
Size: 14KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.data
Size: 797KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ