09e0940cf3f9add5f5705ced0b9dce92_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09e0940cf3f9add5f5705ced0b9dce92_JaffaCakes118
Size

111KB
MD5

09e0940cf3f9add5f5705ced0b9dce92
SHA1

234d8898a1d167ab39022787e252da9f872e86cd
SHA256

1bcf2d307c1d587dc8ed95fde4212c1778d136d56fc2d2f1a721eb32942c870b
SHA512

182aff876e660918ee7c63f804a95bed24532c491ba5f3079c2e73594975e6987cb5a6f5c2777261c9d3a513bf6a7d354abc890c51b408daaa8835dd80dcfeb1
SSDEEP

1536:sc48KKDpPvWWWFFRcdOfmdQ/R9S//9rgVtN4ENZvIu9qnLCh:sT8zRuHF2dOuS2/VgVtN4E3Iu9IC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09e0940cf3f9add5f5705ced0b9dce92_JaffaCakes118

Files

09e0940cf3f9add5f5705ced0b9dce92_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0d384c6760b196311990dcb647b29218

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
DeleteFileA
VirtualFree
Sleep
ExitProcess

user32

GetMessagePos
CharNextA

winmm

timeSetEvent

comctl32

InitCommonControls

Sections

.text
Size: 512B - Virtual size: 298B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ