f3d876a5aa5eb0f10e4387f40ed9a128_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f3d876a5aa5eb0f10e4387f40ed9a128_JaffaCakes118
Size

1.3MB
MD5

f3d876a5aa5eb0f10e4387f40ed9a128
SHA1

bc93390580ac0a2e9061dcbcb439e47a29054aa2
SHA256

9099abd81be49e8a75e502c63789a71987d37b0f4c0236fbbdcf468321da0bd3
SHA512

47741f99d76b3eacd24558394fef5d25ed4d4404d9df23d6ff6a2aeb8c881ac4472e186dc8c9bca82a9146670645de7f3528f625274f0a32d9c322f23f8f8dcb
SSDEEP

24576:BFVgmcy0OekWvsYViW0jEE17yXvwkGzqqS6gBTD0ghXwfBRBe9h87fWlGAYNxU+u:BEcMsAiWUEE1G/ZGWq34XwRe0+iT7K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3d876a5aa5eb0f10e4387f40ed9a128_JaffaCakes118

Files

f3d876a5aa5eb0f10e4387f40ed9a128_JaffaCakes118
.exe windows:6 windows

05906f5692577c3f44ec61e5fd707fd3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

k:\finspy2\finspyv2\src\target\overlayload\objfre_w2k_x86\i386\overlayload.pdb

Imports

kernel32

CloseHandle
ReadFile
VirtualAlloc
GetFileSize
CreateFileW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp

ntdll

RtlUnwind

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ