261b2b679e487f6881770d65a991aa0c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

261b2b679e487f6881770d65a991aa0c_JaffaCakes118
Size

641KB
MD5

261b2b679e487f6881770d65a991aa0c
SHA1

26a2657c47339fabbfd7032e3f6c1e79fa44c6c1
SHA256

dd68cbbcef4970dcfd340175ee6e7ea22398dee322d6ef1200bff50dd51db80f
SHA512

8f2ba0f7d812be13c10db142ab5200cd3b373a83498e937e505f7237fe2a4f92067367c881e56eb2b778ca9a71f2f342026faaa1ed0cd4bd5fb942121a25fc73
SSDEEP

12288:2Bd52bW0Aqu4vv23fmcIfwT9uob0aHX5VVYqWpIM0JbeyDir:2BdRHQ4fJwwTt0gXASM0JbeEir

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
261b2b679e487f6881770d65a991aa0c_JaffaCakes118

Files

261b2b679e487f6881770d65a991aa0c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

77a16f241bbe5273536579b239d790da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

odbctrac

TraceSQLConnect
TraceSQLFetch
TraceSQLBindCol

kernel32

SetErrorMode
FindFirstFileA
FormatMessageA
CreateProcessW
GetSystemDirectoryA
SystemTimeToFileTime
GetEnvironmentVariableW
CreateSemaphoreA
GetVolumeInformationW
GetModuleHandleA
OpenFileMappingW
GetProcAddress
GetCurrentThread
Sleep
GetTickCount
ReadFile
OpenEventW
MapViewOfFile
HeapFree
GetFileAttributesW
HeapAlloc
CreateFileA

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.yml
Size: 626KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ