18da76f34abfb3b40fb8e3d43767c731_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18da76f34abfb3b40fb8e3d43767c731_JaffaCakes118
Size

23KB
MD5

18da76f34abfb3b40fb8e3d43767c731
SHA1

00fc3dd9cf5aa06bb0dc633456879dab79fcafba
SHA256

f8c8550bf99ec567648bb85d400d6ab242503c6a2a1afd660a1c4ba5be92e278
SHA512

f3c852eb870b9547cd6244c1f02cc26552f70d38ca47a044c3cf94c1cbacc8d325e18b0441061e4eb7cca6c1bf201d356488d76a6d854d57dd1ead464e478f16
SSDEEP

384:AeE+8X4lVOyAkSrSN19PWk+73hbSx8koSBrcbtT:hV1oEPWkUbSxV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18da76f34abfb3b40fb8e3d43767c731_JaffaCakes118

Files

18da76f34abfb3b40fb8e3d43767c731_JaffaCakes118
.exe windows:5 windows x86 arch:x86

cf2297eb1741ef4b8afaf65e0cda04ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\_s\Release\server.pdb

Imports

kernel32

IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE