139bb66ce35ea352009f2c4ac4873420_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

139bb66ce35ea352009f2c4ac4873420_JaffaCakes118
Size

395KB
MD5

139bb66ce35ea352009f2c4ac4873420
SHA1

6926c6d4ab2b1affb16f071c5749399cf9b5991b
SHA256

0742563677c0616ee1cae4cf8777cadab0d0bfb664a6b31cccac70fc9ad006ce
SHA512

d468de2e0027e41dcb32a8b6aebf566a40c5ce6c6337c5ecb0125fd28c7c3a4f058b1984d390f62cb309966e377d978a5e2a55d0c98fe7ab32e5bd6470a88d43
SSDEEP

12288:ROE4/k/ht3JzqqziId+gX2S6aTny2uKmrE:ROE4spt3tLGId+gm6Rur

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
139bb66ce35ea352009f2c4ac4873420_JaffaCakes118

Files

139bb66ce35ea352009f2c4ac4873420_JaffaCakes118
.exe windows:0 windows x86 arch:x86

3c21f201ae2742ab4ec2f693c60db359

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateFileA
RemoveDirectoryW
RemoveDirectoryA
ReleaseMutex
ReadProcessMemory
ReadFile
GetLocaleInfoA
QueryPerformanceCounter

quartz

AMGetErrorTextA
DBToAmpFactor
AmpFactorToDB

Sections

.text
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 508KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 390KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE