097b3ed97827fcacf185aa3123bdc2b3_JaffaCakes118 | Triage

Sharing

General

Target

097b3ed97827fcacf185aa3123bdc2b3_JaffaCakes118
Size

26KB
MD5

097b3ed97827fcacf185aa3123bdc2b3
SHA1

bee4b2bd70386f0d479e27c607989ff36aac0056
SHA256

6dc046cf96982b37d38ff70606611006b38631d3ff06e68cd5adaf40304562ac
SHA512

01401b92a89948c0a8ff1989eea07de93165c7dc0d95682681fd8128c24311a5b360f68d40d974b58e3383aafc8e47c78f887fe23db0ef021e46cf1334d3f48f
SSDEEP

768:mfnm1fqn9ONV2NbgX+T6TrQOXNHWTFqU9X:2m1pMbw+T6Tr32X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
097b3ed97827fcacf185aa3123bdc2b3_JaffaCakes118

Files

097b3ed97827fcacf185aa3123bdc2b3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

34e12621b7e18acbb337fbd16ddcde1e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
VirtualProtect
ExitProcess
VirtualProtect
ExitThread
VirtualFree

msvcrt

strcpy
_CIacos
memcmp
_mbsnicmp
_mbsncmp

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE