23700141b2dea46d75dc9dc3b4c21a25_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

23700141b2dea46d75dc9dc3b4c21a25_JaffaCakes118
Size

58KB
MD5

23700141b2dea46d75dc9dc3b4c21a25
SHA1

f9fbdb3f7b07e8bd81d27e8b7e3cbf5da67d520b
SHA256

882d6490dc7617527b04328d74ff455e7263caadb51d39a7f18c2780ad69afec
SHA512

51ad4e67cf7652123f5074ae363ebb798653a329a72079cd2b17ee09144c02ea5cfd086f02679b644724dbe57226fa0abcead9c99a01e4324c7771d430716f2a
SSDEEP

768:WnN+Cq6dk/mEaKCzdY4Ux1Wz/3mmOSTO93G8U4c6c:WNhWruzG4U/8OPjY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23700141b2dea46d75dc9dc3b4c21a25_JaffaCakes118

Files

23700141b2dea46d75dc9dc3b4c21a25_JaffaCakes118
.exe windows:5 windows x86 arch:x86

442ca733a3b7d78f1b442be17ee504bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
_onexit
memcpy
memset
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
??3@YAXPAX@Z
__dllonexit
_stricmp

psapi

GetModuleFileNameExW

kernel32

GetModuleHandleA
ResumeThread
WriteProcessMemory
IsDebuggerPresent
VirtualAllocEx
GetProcAddress
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
GetStartupInfoA

Sections

.text
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sdata
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ