5d80d2c966000fe98ecdecc2ee4de654_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5d80d2c966000fe98ecdecc2ee4de654_JaffaCakes118
Size

394KB
MD5

5d80d2c966000fe98ecdecc2ee4de654
SHA1

d6bc3d9d0f952ceb69b1972724944b1493db5997
SHA256

e283071753b1da54f0606f545bac0baa72c3800a598216502775627400daa3de
SHA512

7ba2fc320c903a8a248736d8b03ca7efb91e7c80c26cff6d6e03345eec3deda775eaf177b6f2fb491784616c88c387aa3151c13b8b1f386db068f07e065f33e6
SSDEEP

1536:2Zuoc0tZLpg/fLdaOUp1IHphFhTPlGdtRnjTcCP5zhC6XXXXXXz0DPRAgZw8dhQ:2dca0Td+1IHkLRnj/zhC6XXXXXXGhQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d80d2c966000fe98ecdecc2ee4de654_JaffaCakes118

Files

5d80d2c966000fe98ecdecc2ee4de654_JaffaCakes118
.exe windows:6 windows x86 arch:x86

0538e1ecd2ca1ff50132c5342ca8ff6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

appvisvsubsystems32

ord1

advapi32

RegCloseKey

vcruntime140

memset

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.MPRESS1
Size: 5KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE