06ba1d649102d179efa3c8498eaad43b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06ba1d649102d179efa3c8498eaad43b_JaffaCakes118
Size

78KB
MD5

06ba1d649102d179efa3c8498eaad43b
SHA1

68929b70f8764c9e0fd25c969f03a4606fb94280
SHA256

97703d85bc26ac98fea8c04b0a5dbbd10ff59990a59f7f8c014cdad37bfc2540
SHA512

61100014aaa9a52b4a09dd2659d3fe907cb9b3a2bfbc30331e802f00642b274e9e3521be6d4c92c779026b64bc45f2f3b56f4c3d7e5de53f24be6f7f4a186385
SSDEEP

1536:XjnvJk+3m5U/bc/JGBFvQ6poPXmH/Vw+rrOxmak//hfydGqOoi4Rq:znBkITbMJu6/WCm7Fhfydb1E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nero 12/Patch.exe

Files

06ba1d649102d179efa3c8498eaad43b_JaffaCakes118
.rar
Nero 12/Patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Nero 12/Read Me.txt