1eb04118216a3b03670bfa68903f7d30_JaffaCakes118 | Triage

Sharing

General

Target

1eb04118216a3b03670bfa68903f7d30_JaffaCakes118
Size

484KB
MD5

1eb04118216a3b03670bfa68903f7d30
SHA1

9931d5405850eb9ad8ed01d6c23c4ad279e8a9ee
SHA256

b5b9adb09ab75a367d58a8c97a5d4954e90a9bdabaa63c826da4bb87d3e14d45
SHA512

9e097ffa8370cfec6e69ce07f6386d1923eb4174cb874f7710d6ade094c76f289f6f504b6e049527df8d2f95c93b4f8f172d96030f293cbf02bb58da5a3ca1fa
SSDEEP

12288:yLPkCDt1EG2XVekhdeToU+L5FWL6VhWQN4/Y:yLPkQ1bqAdEFWgh2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1eb04118216a3b03670bfa68903f7d30_JaffaCakes118

Files

1eb04118216a3b03670bfa68903f7d30_JaffaCakes118
.exe windows:5 windows x86 arch:x86

18c89e2ec0a399c68eaedd6551ce71fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualAlloc
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.l2
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ