288a39efccd32da67b73e80aed492709_JaffaCakes118 | Triage

Sharing

General

Target

288a39efccd32da67b73e80aed492709_JaffaCakes118
Size

16KB
MD5

288a39efccd32da67b73e80aed492709
SHA1

e17d996fcb9dd1bfecc6ae94333f63b90e51d46f
SHA256

b5daf51b34835e5aa3d9d7401308a45dc937331290ef28c5d0bbfaf218400298
SHA512

6fc77b513bf1384fe156a0556f7f548f6f29ec95d094aacb9bff8dfef58c02d67cbd8e7eb7a30164efc3fa3c4f824df69f9ccdfb67dfa99c2b81ebdfcd3dfd9c
SSDEEP

192:2rlsbCO8ud927VQHY6kNXzD8RQxoFY+US822rT5xTp:cv1bZbDX8RQxRdS83Zlp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
288a39efccd32da67b73e80aed492709_JaffaCakes118

Files

288a39efccd32da67b73e80aed492709_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1c6080324206b2bb90ca812921e5094f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcatA
lstrcpyA
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
CreateProcessA
ExitProcess
CreateFileA
GetTickCount
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
Sleep
ReadFile
OpenMutexA
ReleaseMutex
CloseHandle

user32

GetKeyState

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 576B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE