ed4bde81374fefd16a9044f4ee410ad2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed4bde81374fefd16a9044f4ee410ad2_JaffaCakes118
Size

17KB
MD5

ed4bde81374fefd16a9044f4ee410ad2
SHA1

6fe629f7063c07aa87e56af28d982849856dcbf3
SHA256

e836878d19b9c5225cf7980b013c72b7a51618b36427a77fb04e86c1bd87bf05
SHA512

04e9ff5e0cd243b19004de3c863501d87cef5ff389beb61e8208f72007ddcd7a421af47651363b0b08a0db993887f31df8156489e0c460561a09182e21f1381e
SSDEEP

384:pc0hmHoOOdDOpbA0EICjw7eLDe0FCSdlmQx4Robs7D/cISwO+s/drNHFgB+:lMIOn+e7eLfFz3mQx417ywO+s/dxHS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed4bde81374fefd16a9044f4ee410ad2_JaffaCakes118

Files

ed4bde81374fefd16a9044f4ee410ad2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4582ffdd7eb98cb63a937096204182b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\XRoot_Build\X7.0\Vm\Release\x86\StubExe.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
GetCurrentProcessId
OpenFileMappingW
GetLastError
MapViewOfFile
CloseHandle
CreateFileW
CreateFileMappingW
UnmapViewOfFile
GetFileInformationByHandle
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
LoadLibraryW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 848KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ