2f5ffa817300d3f885115db13d68157d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f5ffa817300d3f885115db13d68157d_JaffaCakes118
Size

813KB
MD5

2f5ffa817300d3f885115db13d68157d
SHA1

d368faf7cb4bf6e4bbc929ee7bd8e9ba47e7638e
SHA256

90395faab74717fe0f49d248a1fdc2c8c1abc9ebf0cc9afc086b309d34403ea0
SHA512

caf790ae411015ad8d299215c32edb791764b6dd51721eb56fe9d1e1d624f85810fc14eee961900317277b6e944c55c49ce7c4a69c7ea4451daa8c6d8ff8b764
SSDEEP

24576:Sw8ss+am34TVW86V1ZXqJnsBPJyLcbI0vq5:Sr+wT21+st8Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f5ffa817300d3f885115db13d68157d_JaffaCakes118

Files

2f5ffa817300d3f885115db13d68157d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

427aafedf21463b4df2601150594754f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetStdHandle
WriteConsoleA
HeapFree
CreateMutexW
lstrcpyA
GetPrivateProfileIntW
HeapCreate
WriteConsoleW
GetCurrentProcess
GetVolumeInformationW
SetCurrentDirectoryA
GetStringTypeA
SetEnvironmentVariableA
GetTickCount
SetVolumeLabelA
GetVolumePathNameW
CreateEventW
GetShortPathNameW
LoadLibraryA

aaclient

g_fnStartTransport
LoadClientAdapter
OpenKeyReaderWriter
OpenKeyReader

Sections

.CODE
Size: 9KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kdata
Size: 1024B - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: 801KB - Virtual size: 801KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ