36922b0af588347e17df4ff7394700c7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36922b0af588347e17df4ff7394700c7_JaffaCakes118
Size

60KB
MD5

36922b0af588347e17df4ff7394700c7
SHA1

ae73a23720bc355fdcf69082695ce5a0bf042124
SHA256

97aede0a8714fe7714d029a16b2122e15c8b6e07ebd619ab29b41b0f1e6f4932
SHA512

3615c209427de4b3c245e63906c400985bb6c494abdabc2d3aba318bc31ac36ea1ce712ceeb9ab5d4e0e5000e052f915686507875a1ad22485ae8f2c1e3251c3
SSDEEP

768:FH5A31r4G17p9Q5GFai+7dEyVTTHcKCh9baJ4BAO34V6ldqw4KMF4u96MUj2hvlW:q7bQ5hbdEE0KCOU49iMW6UjWN+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36922b0af588347e17df4ff7394700c7_JaffaCakes118

Files

36922b0af588347e17df4ff7394700c7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bfeea31278ac45389f87724265059895

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchange
GetPriorityClass
CreateEventA
GetPrivateProfileSectionA
GetExitCodeProcess
Sleep
GetPrivateProfileIntW
LoadLibraryExW
GetModuleHandleA
GetPrivateProfileIntW
SetFilePointer
HeapCreate
lstrcmpA
lstrcmpiA
OpenMutexA
Sleep
CreateDirectoryW
GetDiskFreeSpaceA
SetEnvironmentVariableW
GetDiskFreeSpaceA
Sleep
GetFileAttributesA
WaitForMultipleObjects

catsrv

DllCanUnloadNow
OpenComponentLibraryTS
GetCatalogCRMClerk
CreateComponentLibraryTS

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE