0b9dc38765d890d4a0bb24180c95c854_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b9dc38765d890d4a0bb24180c95c854_JaffaCakes118
Size

52KB
MD5

0b9dc38765d890d4a0bb24180c95c854
SHA1

c865ef1217a52ee5dfbc39289eec889e2e3eb8eb
SHA256

15c67ef69ffd7e3f046769d14986764c0ff50269ed54cf6336a5930b33ea07b9
SHA512

3e3dd24a37f1f993a4803df253781734db99bb000411a047c24b70956ee88834cde0d0d916fd6152e6410a7f5cf84ab52f46fd169a0c36012baeed8c1717a976
SSDEEP

1536:bkZzd3DeGugf5sFNBOHpzu5+yjdUlnPRr:gZzdTeGWNkJ8+yc9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b9dc38765d890d4a0bb24180c95c854_JaffaCakes118

Files

0b9dc38765d890d4a0bb24180c95c854_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e1d46e3bf6a210f761f54a7abb04fc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetTickCount
GetLastError
lstrlenA

user32

wsprintfA

advapi32

OpenServiceA

ntdll

strncpy
memset
memcpy
strlen
strcpy
strcmp
_allmul
wcscmp
wcscpy
wcslen
strstr
RtlUnwind
NtQueryVirtualMemory

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 26KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE