15dda8c647f60a93c47ca1bee6cd756d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15dda8c647f60a93c47ca1bee6cd756d_JaffaCakes118
Size

304KB
MD5

15dda8c647f60a93c47ca1bee6cd756d
SHA1

60be01829328b3352acb14fd01bdd9fba37d43b8
SHA256

2ed866c3ea38deeaf3e693216fecc1da326e8c6c52273bc8d6db953e2e971ab1
SHA512

bd7caf44c46f0a579f06974fd923f97a1b844c5f0840670281191d9ca5422b0f1882f94e715aea72ea046c1ca98527d4bc2bdea3b55c087422a31093dd0b0f86
SSDEEP

6144:i2tzOXHMVH3aR17U66wyTTxueX2KtAdB6z443iYT:io1VXaR17U6kFue9yd14D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15dda8c647f60a93c47ca1bee6cd756d_JaffaCakes118

Files

15dda8c647f60a93c47ca1bee6cd756d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

71d6696b7928088c850ff2983f9474d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
SetFilePointer
HeapCreate
CreateDirectoryA
GetFileAttributesA
InterlockedIncrement
Sleep
GetDiskFreeSpaceA
SetEnvironmentVariableW
GetPrivateProfileSectionA
GetDiskFreeSpaceA
WaitForMultipleObjects
Sleep
lstrcmpA
GetLongPathNameW
Sleep
GetPrivateProfileIntW
InterlockedExchange
GetModuleHandleA
FindResourceW
GetPrivateProfileIntW
GetExitCodeProcess
lstrcmpiA

catsrv

OpenComponentLibraryTS
CreateComponentLibraryTS
GetCatalogCRMClerk
DllCanUnloadNow

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE