0c5f9bb5417838beb232b8f9d801c46d_JaffaCakes118 | Triage

Sharing

General

Target

0c5f9bb5417838beb232b8f9d801c46d_JaffaCakes118
Size

64KB
MD5

0c5f9bb5417838beb232b8f9d801c46d
SHA1

04593b0192773c7ec00c946a86316de6c84c37cd
SHA256

55956d5e1c84bb9c9e5bd01b28d612b22509c5d6f35860a1898f5c4d630b1cc0
SHA512

578080563cb2bcbf7f4b7136f5df97e94d34f3cd749273653d39779836253b3c4a0ab93036ba25beae187007bda4b6601c17c8987c4538dc3b9a01bc04b5d43a
SSDEEP

192:UshA7+caAZZGv8KRdZMFu2tx+8dE3UzSYUrGuuvVKRdZMFu2tx+8dE3UzSYU/:UsC4AZZL1xq3UZU9a1xq3UZU/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c5f9bb5417838beb232b8f9d801c46d_JaffaCakes118

Files

0c5f9bb5417838beb232b8f9d801c46d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2edac859905793c7264e5d89f98d853

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Download\test123\3434\Release\3434.pdb

Imports

kernel32

GetModuleHandleA
CloseHandle
ReadFile
GlobalAlloc
CreateFileA
GetSystemTime
GetModuleFileNameA
GetTickCount
Sleep
GetProcAddress
LoadLibraryA

user32

GetKeyboardLayout

Sections

.text
Size: 4KB - Virtual size: 701B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 526B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ