20f87aad6646c082efe95c49a4dffe55_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20f87aad6646c082efe95c49a4dffe55_JaffaCakes118
Size

25KB
MD5

20f87aad6646c082efe95c49a4dffe55
SHA1

1613227d5748d4030bea18f1a5029e1af5801926
SHA256

4ede394fa247b9272d65baf0bedce08ad9ef31db4741fd6a8eb169da12ecf562
SHA512

6dd298336fbabd55e6f2cc6b54bc56d3d2f6474b2756721300752b6c25995195518e8ee1baba178905f1fbe8695ab2950dc4a7a4c17a22a5e1c49cd04534f32c
SSDEEP

192:icovrqyS06V/YJs0nuVoeVqFow6G7e2B0pZHa8fPYwrBR+lF0VoSN/5G9wywaqLU:nMuX5oF/8nYyBRzN/5G9wpL0lHipIp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20f87aad6646c082efe95c49a4dffe55_JaffaCakes118

Files

20f87aad6646c082efe95c49a4dffe55_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6f14120b27bcce445ca4e02efb3b461c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW

advapi32

RegOpenKeyExA
RegOpenKeyExW

kernel32

IsDebuggerPresent
TerminateProcess
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data2
Size: 512B - Virtual size: 6B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ