423c75972b5d8c84fa9cde2f6b4f8147_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

423c75972b5d8c84fa9cde2f6b4f8147_JaffaCakes118
Size

818KB
MD5

423c75972b5d8c84fa9cde2f6b4f8147
SHA1

632d60967b4a6c02903165544213a769800b6b78
SHA256

d45765a4ff4c2edbb4cd8573c2d73185cbbcbff721daba964a1e4c009fc611c1
SHA512

31cac30a05ad513cf92634763fb021a5d33a8b8e5790bc9263f44beab8c49168024e6d181f757d3f25cb4fde4b1db47b94b59e50f31507809b5a0c38ce110553
SSDEEP

12288:y+1XSlf3gK5h6bHUe0K+uDbTJBQ0MB95Izi3z38E62wOCK1Gp8QxVmjj6rJz:y+1U/gYO0t2DbDjMazibwjSGxA6rJz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
423c75972b5d8c84fa9cde2f6b4f8147_JaffaCakes118

Files

423c75972b5d8c84fa9cde2f6b4f8147_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a1068baf6b7c60cd645fd3cf20a3a38b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
SetLocaleInfoA
lstrcatA
GetCurrentThreadId
GetFullPathNameW
VirtualProtect
SetThreadPriority
GetCommandLineA
WriteConsoleW
GetModuleFileNameW
SetCurrentDirectoryW
lstrlenW
ReleaseMutex
TlsGetValue
GetModuleHandleA
DeleteFileW
GetPrivateProfileIntA
FormatMessageA
VirtualQuery

azroles

AzAddPropertyItem
AzApplicationCreate
AzApplicationDelete
AzApplicationClose

Sections

.text
Size: 15KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.data
Size: 797KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ