218fe4e9a2142f0279a5735bd3252082_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

218fe4e9a2142f0279a5735bd3252082_JaffaCakes118
Size

126KB
MD5

218fe4e9a2142f0279a5735bd3252082
SHA1

a4ecc61b5669b1d9b7b9f83d19110ab31d86d7fc
SHA256

d3b8d246a1bdb8ffbddef9658844dd606160f7ef51ca2f233bc47b832d8163f1
SHA512

43667f1e6a13357da2dafc4e2f4b1e21b9412e037dfa48b1ea3de0915a115a64ff8d67bb85189f842995acc4947955a8b739c3393afbc01b273ea272d447624e
SSDEEP

3072:EiBAyIuO8oUlnRcSiVCUixtjx6HtpdPzb:R7IuOvOncVC/CzJzb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
218fe4e9a2142f0279a5735bd3252082_JaffaCakes118

Files

218fe4e9a2142f0279a5735bd3252082_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2ba6438a5cf3d526f8b41f260938957a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlComputeCrc32
RtlImageDirectoryEntryToData
RtlUnwind
NtQueryVirtualMemory

kernel32

SearchPathW
ExpandEnvironmentStringsW
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
LeaveCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW

comctl32

ord17

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ