0c23973e3093fb7303178cf3a26db7f4_JaffaCakes118 | Triage

Sharing

General

Target

0c23973e3093fb7303178cf3a26db7f4_JaffaCakes118
Size

32KB
MD5

0c23973e3093fb7303178cf3a26db7f4
SHA1

71653b99efa6d84ce4a5a7490f0093894dd2d4b6
SHA256

2df8b4955ee6703e95d23a006ba7b64faa759ef2e2f7d69097060038a6ae19e4
SHA512

cc20cf6f6c01c22f190a81fca2d5438da82dbd94221c3a346c946a39d52f946ee80bd96f8fe2ba9c7ef3539baa3d963864898fbb03b909cc702ec6dfaf345094
SSDEEP

384:oo8HK+tT3CZVujqQDw1Bz7J95jKzTFa7UXhE3Ags152KXo9KWjBYBrKuupRqWr7V:ji3Cvz7JzKP8UxK+kKXohYrKVB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c23973e3093fb7303178cf3a26db7f4_JaffaCakes118

Files

0c23973e3093fb7303178cf3a26db7f4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

21769c242ca920c94512e110a9f6a88d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateFileA
MoveFileExA
FreeLibrary
WriteFile
GetSystemDirectoryA
lstrcatA
GetLastError
lstrcmpiA
GetProcAddress
LoadLibraryA
MoveFileA
GetModuleFileNameA
WinExec
CloseHandle
DeleteFileA
lstrcpyA

user32

CopyIcon
SetSystemCursor
LoadCursorA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ