4603341a8110d7578e494b8258bc3830_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4603341a8110d7578e494b8258bc3830_JaffaCakes118
Size

825KB
MD5

4603341a8110d7578e494b8258bc3830
SHA1

f6b3a1611ed6a1a9cbcaa217d1e8239fdb826b14
SHA256

ebb566706dd3c2636a1b1a3cb57dd818fb256078c7043ef39d249b168b8ce16d
SHA512

d5cbc26439a798728d6920b83aeba72f92568b47f8a40483225481d519095f2340d59e39c019be1a9606470d814482f1c81216a1a7798e7ae097f121bdbc61bd
SSDEEP

24576:Lb21v8CoBwAMVqIo5E3gbFELjK5pTGgzQfb24MKC:fLvwAM4yie3I74ZC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4603341a8110d7578e494b8258bc3830_JaffaCakes118

Files

4603341a8110d7578e494b8258bc3830_JaffaCakes118
.exe windows:4 windows x86 arch:x86

db4447a27f48f8fc931943695dff18d7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDiskFreeSpaceA
OpenEventA
CreateMutexA
CreateEventA
GetShortPathNameW
GetStringTypeA
lstrcatA
lstrlenA
GetVolumeInformationW
GetDriveTypeA
GetTimeFormatW
GetPrivateProfileIntA
SetEnvironmentVariableA
GetModuleHandleA
VirtualAllocEx
FoldStringA
GetTickCount
HeapFree
WriteConsoleW

msdtcprx

DTC_XaStart
DTC_XaOpen
DTC_XaPrepare
DTC_XaEnd

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 800KB - Virtual size: 800KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ