175e18bf337a9396dd4e7ee692cd0010_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

175e18bf337a9396dd4e7ee692cd0010_JaffaCakes118
Size

324KB
MD5

175e18bf337a9396dd4e7ee692cd0010
SHA1

01ef42d6cc0b7b7efbe277527ac5ba957cecfdc2
SHA256

a3d44def12490151042d2bc59b9a58637805fc1c32458369cf6755143f30b141
SHA512

836736c2320d3fb75a204bbfd1ce49efa5254e62fb97befa5a85628a7fc072358c3423bd76fac558ede1847a96be614507475272fecd86efcb429200a870f7d4
SSDEEP

6144:13uuMSvKbnWuGPZtYZWGQS37cy6aLm57k3CItIFNSpVQpe9ix57v5FMH70//kwcv:13VvKLgnGQC6aLQYCIti0VQyixp5uH6I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
175e18bf337a9396dd4e7ee692cd0010_JaffaCakes118

Files

175e18bf337a9396dd4e7ee692cd0010_JaffaCakes118
.exe windows:4 windows x86 arch:x86

869ce39680d3ec2c89af36e3ebb4fc5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memcpy
memcmp

kernel32

CreateFileA
DeleteAtom
DeleteFileA
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
GetProcAddress
LoadLibraryA
GetEnvironmentVariableA
ReleaseSemaphore
IsSystemResumeAutomatic
GetThreadLocale
GetConsoleCP
FreeLibrary

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ