246090055046c0d23c83b779d04c57ad_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

246090055046c0d23c83b779d04c57ad_JaffaCakes118
Size

20KB
MD5

246090055046c0d23c83b779d04c57ad
SHA1

30f8f24e639fd1ef6baa7dc87dabc3b6fca94fde
SHA256

c3f8bbe231c2c934a893d9aef6c20385cff438a313f7930ec58d7100442bce2d
SHA512

94978f90013bb242af7493ecf5bcbe84d0ef72543f39e5acf365371566831dabc323eeeac8743eeabd9fb5894a3a551a2b0cd3a215f402d1dd8cc9c7c0abd75d
SSDEEP

384:Ebm+Uk4qnAdNoJCfoXZHogRrhdNG70rehtrTCAUlXTyq0zPm0ZT:E8k4LlwpHDR1prehtaAbt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
246090055046c0d23c83b779d04c57ad_JaffaCakes118

Files

246090055046c0d23c83b779d04c57ad_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bb462479d3c96966d5862d919624526d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\_s\Release\server.pdb

Imports

kernel32

QueryPerformanceCounter
GetLastError
HeapFree
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetFileSize
lstrcpyA
GetExitCodeProcess
SetNamedPipeHandleState
DuplicateHandle
CreatePipe
lstrlenW
GetLocaleInfoA
QueryPerformanceFrequency
GetSystemInfo
GlobalMemoryStatusEx
ReleaseMutex
WaitForSingleObject
TerminateThread
LoadLibraryExA
GetCurrentProcessId
GetCurrentProcess
LoadLibraryA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE