570cb3ab310914465a5ab92ff4d7ef9e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

570cb3ab310914465a5ab92ff4d7ef9e_JaffaCakes118
Size

817KB
MD5

570cb3ab310914465a5ab92ff4d7ef9e
SHA1

30c086d6c54c476a1e6cd6b67fc14b4175aa29c9
SHA256

47551eb79555558575b037e29eec50057568356ab83cfbef182d5dcfcb62fd3a
SHA512

79f8f3e9e31e436805a9e3c848f3514b6b7a1b4b590962992be8d050e365acfbf55032abcf1ddd00a66da152e3de21513869d40b458c512732c3153cf3a01491
SSDEEP

24576:EtvVHRVkrZWFLH46FX+GDP0dYifMUhFGp7Y:EtvVxK0FbFuA2/kBp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
570cb3ab310914465a5ab92ff4d7ef9e_JaffaCakes118

Files

570cb3ab310914465a5ab92ff4d7ef9e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

794ff126527f4febcc5485dcd13010e7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
ReleaseMutex
FormatMessageA
GetCommandLineA
GetFullPathNameW
GetModuleFileNameW
SetLocaleInfoA
TlsSetValue
WriteConsoleW
GetPrivateProfileIntA
SetCurrentDirectoryW
VirtualQuery
TlsGetValue
lstrcatA
GetModuleHandleA
DeleteFileW
lstrlenW
VirtualProtect
SetThreadPriority

azroles

AzAddPropertyItem
AzApplicationClose
AzApplicationCreate
AzApplicationDelete

Sections

.text
Size: 14KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.data
Size: 797KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vdata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ