1239f839f7e7cdc0a4d12b81e69a5ffd_JaffaCakes118 | Triage

Sharing

General

Target

1239f839f7e7cdc0a4d12b81e69a5ffd_JaffaCakes118
Size

20KB
MD5

1239f839f7e7cdc0a4d12b81e69a5ffd
SHA1

3570c173219fc7e07f606f202269f34e14ae6f59
SHA256

92479b917a1a96266eadfc41eaa05839ee4c1f2293881e56a6ea2bc46489df61
SHA512

327f54fc897d1228e5fe87d39b0773a94719de1ff4a496178c0814504665ad760f889946c2e162d0e652920c34476a0107602648edd90474f9d95a46ee3897f3
SSDEEP

384:AgM4HoOOs6Hj0wKfKfLTcJw2aTOhqsp33Bdns/v6gNkBoZ4x:A4IOwjKfKfLyNhFBZSiG9+x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1239f839f7e7cdc0a4d12b81e69a5ffd_JaffaCakes118

Files

1239f839f7e7cdc0a4d12b81e69a5ffd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

08da5ec80406581b76eae64d14e4f631

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\bamboo-home\xml-data\build-dir\SPOONVM-VM3-JOB1\vm\Build\Output\x86\StubExe.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
GetCurrentProcess
GetCommandLineW
OpenProcess
GetLastError
DuplicateHandle
GetVersionExW
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
OpenFileMappingW
SetEvent
GetFileSizeEx
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
LoadLibraryW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 868KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ