06408e9077d924ec4adeb2af5f64ad60_JaffaCakes118 | Triage

Sharing

General

Target

06408e9077d924ec4adeb2af5f64ad60_JaffaCakes118
Size

72KB
MD5

06408e9077d924ec4adeb2af5f64ad60
SHA1

fd23e39ec6c3ad8090e77ea41042a9d74e6be869
SHA256

3bfaf6dc192dae31c373f2c37bc28f1ceff53fc1f12ae2c5862b21ed955f0179
SHA512

8d51ec5953dd59c3ad96838fdbc1af766ee1b9bcc3e8f888e694409a9fce4b7d7edacd28d7846ba2a4d72ff32bd82499cab07e9e951988741bfaa25656c28063
SSDEEP

768:HPOIJa8oy0qNksF/4VBn/KXvB2gwx0ov2uhR4dFC4tsOKMue7kTt/243TdKLJ1Ma:10em/42gw+M4dFnthKBR/dTW71wU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06408e9077d924ec4adeb2af5f64ad60_JaffaCakes118

Files

06408e9077d924ec4adeb2af5f64ad60_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a00fc64b1fe17620bae333099757f510

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
InterlockedIncrement
lstrcmpiA
GetPrivateProfileIntW
GetDiskFreeSpaceA
Sleep
GetExitCodeProcess
Sleep
GetPrivateProfileSectionA
HeapCreate
LoadLibraryExW
WaitForMultipleObjects
CreateDirectoryA
SetEnvironmentVariableW
FindResourceW
GetModuleHandleA
GetFileAttributesA
GetPrivateProfileIntW
InterlockedExchange
Sleep
GetLongPathNameW
SetFilePointer
GetDiskFreeSpaceA

catsrv

CreateComponentLibraryTS
OpenComponentLibraryTS
GetCatalogCRMClerk
DllCanUnloadNow

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE