51efd5c278aebc4378aa45bea441b2a3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

51efd5c278aebc4378aa45bea441b2a3_JaffaCakes118
Size

309KB
MD5

51efd5c278aebc4378aa45bea441b2a3
SHA1

21603dcabefc60bd2889a643bbe2999ed6f4cf16
SHA256

0f9748bd095e6212112889e0e7bd8a6001670e9948794c5a33f567e51ee60041
SHA512

d6e61e86d3e997d08e66a92f74de99c45092c1c9ed30430415bf3b9bb5bcc53d846466175658ed9b8366ce0a2f3fafe16cf9cd75380f9d10cfba9685e07bf103
SSDEEP

6144:PIFhQhuMVbzPrVD++2KYbXCWzOfguYDdfxTAMZLZdRAzGrlm2Emr:PI3WuWbzrVdLYbXqg5DdfZAa1IzGJfpr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51efd5c278aebc4378aa45bea441b2a3_JaffaCakes118

Files

51efd5c278aebc4378aa45bea441b2a3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

dd33a62cca5153618cb8251684633933

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
GetACP
GetCurrentDirectoryA
InterlockedIncrement
GetLongPathNameA
GetExitCodeProcess
lstrcmpA
VirtualAllocEx
Heap32First
InterlockedDecrement
FindResourceW
LoadLibraryA
lstrcpyW
SetEnvironmentVariableA
GetDiskFreeSpaceW
GetPrivateProfileIntA
ExitProcess
GetPrivateProfileIntA
GetModuleHandleW
GetDiskFreeSpaceW
WriteFileEx
WaitForSingleObject
GetPrivateProfileSectionA

apphelp

AllowPermLayer
ApphelpCheckIME
SdbCreateMsiTransformFile
ApphelpCheckExe

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dbg
Size: 304KB - Virtual size: 308KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE