bb99840487a3b6cd641612b2d02cd14a_JaffaCakes118 | Triage

Sharing

General

Target

bb99840487a3b6cd641612b2d02cd14a_JaffaCakes118
Size

113KB
MD5

bb99840487a3b6cd641612b2d02cd14a
SHA1

6231dd81359dbc961b572ed5191756c0d8f910f9
SHA256

3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06
SHA512

ab420f39ef21cf0eebf395fe5506ef87ab02adab8f15366c9deecb17e5266ee88ade649e8cabc19d9538da579a2fec69983ae7e160fb48c35d21e95890112ce2
SSDEEP

1536:oB8o6QvX3L4sT2eonrUL6mksUvbRDEE7a4IGh86I:oB7HPT2eoIOmnUTRQ/4k6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
bb99840487a3b6cd641612b2d02cd14a_JaffaCakes118

Files

bb99840487a3b6cd641612b2d02cd14a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b211ea116aebe41faab10be8e4e88283

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryDosDeviceW
TlsGetValue
VirtualAlloc
DeleteFileW
LoadLibraryW
CreateEventW
SetSystemTime
GetCurrentDirectoryW
CreateMailslotA
LoadLibraryA
FindAtomW
GetCurrentProcessId
OpenFileMappingA
GetShortPathNameA
SetCurrentDirectoryW
WaitForSingleObjectEx
OpenEventW
ExitProcess
CreateFileA
GetProcessHeap

authz

AuthzFreeResourceManager
AuthzInitializeContextFromSid
AuthzAddSidsToContext

wtsapi32

WTSEnumerateServersA
WTSEnumerateProcessesA
WTSFreeMemory
WTSVirtualChannelPurgeInput

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rlc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ