075219f052c2589ee7e314db437a61cf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

075219f052c2589ee7e314db437a61cf_JaffaCakes118
Size

80KB
MD5

075219f052c2589ee7e314db437a61cf
SHA1

04ddd4f027b704b1fdf92cc700dfbe02557853f4
SHA256

014e2de0d69b6d9aa8c17d09ef6038beb9f5bac1e2b5e1ee10e941275595d6a1
SHA512

c19e7328026f99791412208096e67e01c39987ac4b1014c7825d54f986276a4890e58e883f0582c877a22e9c8b534c99aa3758e24c4668919c34f09b18f141df
SSDEEP

1536:f/I5Y0YnP1sfIMpge4oEhgGQ9UVaXk9NSGjRHdqZWhcYshcy5YAtk42V3c:f/I5Y0u0IAge4oEhcUVaU9N1j9d+W9sH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
075219f052c2589ee7e314db437a61cf_JaffaCakes118

Files

075219f052c2589ee7e314db437a61cf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3f00acaf4db21bb32eaad3d95b5c0c75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtAddAtom

kernel32

DisableThreadLibraryCalls
GetModuleHandleA
QueryPerformanceCounter
SetLastError
GetProcAddress
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
VirtualAlloc
GetTickCount
GetCurrentProcessId

atl

AtlMarshalPtrInProc

Sections

.textbss
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ