43d5e5d745f484440ebbfc4f3ee90be9_JaffaCakes118 | Triage

Sharing

General

Target

43d5e5d745f484440ebbfc4f3ee90be9_JaffaCakes118
Size

2.3MB
MD5

43d5e5d745f484440ebbfc4f3ee90be9
SHA1

8c6a02f87a6aed334f53ddfc85319d73812d8737
SHA256

77dddde482b41d95dd1690843f2c487f6450edb735bae5d32bd67834c88944ce
SHA512

d144fd4b9458bb9e77b603be47c7fea357265f1f7fdc9a48209f679d8532b15d8d57f262420ca2f18006030f84d8e3dc96f66338449b32e7ed068d06d5f3ebe7
SSDEEP

49152:pIP7UZkspoROF6/ev4IvqTLc0J7RiC4PafPfEwp0NCFdaQP+BDc+jJYe0:2yb5Ao0HiNvwp0NCaQkweJYD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43d5e5d745f484440ebbfc4f3ee90be9_JaffaCakes118

Files

43d5e5d745f484440ebbfc4f3ee90be9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2498409bd77833c9d05b5ab6024f7290

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

RtlGetLastWin32Error

advpack

GetVersionFromFile

kernel32

CreateProcessInternalA
GetEnvironmentVariableA
GetLastError
GetVolumeNameForVolumeMountPointA
VirtualAlloc
FindFirstFileExA
FormatMessageW
EnumSystemLocalesA
ReadDirectoryChangesW
FreeUserPhysicalPages
SetVolumeMountPointW
SetVDMCurrentDirectories

mcicda

DriverProc

msvcp60

_Toupper

Sections

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 661KB - Virtual size: 661KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 14.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE