21b86e4f70d18d9d0480b5bf4ed6b0de_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

21b86e4f70d18d9d0480b5bf4ed6b0de_JaffaCakes118
Size

3.0MB
MD5

21b86e4f70d18d9d0480b5bf4ed6b0de
SHA1

3288b8e62790d5ab520258bf5e6b1a03adb91b80
SHA256

94a66d8e44449a44bae22f9b90fb257bf41437b0b285ccbb1bfa05aae93fa5aa
SHA512

7cc8b0826e1626168c839737b2850819c0b183268507d5835a23c9fdf3b892ba92150f45a15e1c3f2f38375f649cef876a69b3170658c61ccd8321ff99bc7f97
SSDEEP

98304:boM9n2WFQYsjTXSVOYeoEXo9yJB2raw5MnG3hHk:boM92VY4C9enY9Q0M0q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21b86e4f70d18d9d0480b5bf4ed6b0de_JaffaCakes118

Files

21b86e4f70d18d9d0480b5bf4ed6b0de_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6080bfe3235cf25f8aae61b780e07a41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 1.8MB

.idata
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ