118a3a614d1d739aa12f4cce14be44f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

118a3a614d1d739aa12f4cce14be44f9_JaffaCakes118
Size

64KB
MD5

118a3a614d1d739aa12f4cce14be44f9
SHA1

38162e649cbdecc295882283c9ec1fc9f26a441e
SHA256

ec40b9bdd5cf933e9b76fc9dde5bf59b929f876a99382a8e3adcdba7bb8ea82d
SHA512

16152e9fe379aef9d01e8e4dd174b8a5343ad3917ccc14e4b5ca60a387ea385e68599c66bdc25c9e955cc2c5fb3ebd51912cc1a380f1feed361880ef1f62ba71
SSDEEP

1536:8Sw7Oxy4NkUy11Ls/BLY0COEcHZWkEaulFp4SrwW2/3uIVOPVuSuEOea:qMbBy11Ls/BLXEc5Weul4+wW2/3uIVmc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
118a3a614d1d739aa12f4cce14be44f9_JaffaCakes118

Files

118a3a614d1d739aa12f4cce14be44f9_JaffaCakes118
.exe windows:6 windows x86 arch:x86

48a989e741342698d805831be9f186d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

OpenServiceW

msvcp60

?_Xran@std@@YAXXZ

msvcrt

exit

atl

ord32

ole32

IIDFromString

oleaut32

SysFreeString

ccmcore

?Free@Memory@CCM@@YGXPAX@Z

tsmessaging

??0CLibSMSStatusMessage@SMSMessaging@CCM@@QAE@XZ

tscore

?IsWinPE@Utility@TS@@YG_NXZ

ccmutillib

CcmClearSecurityToken

crypt32

CertFreeCertificateContext

version

VerQueryValueW

Sections

.MPRESS1
Size: 59KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE