2b5ae11e52244db3aa2ce507db68e747_JaffaCakes118 | Triage

Sharing

General

Target

2b5ae11e52244db3aa2ce507db68e747_JaffaCakes118
Size

79KB
MD5

2b5ae11e52244db3aa2ce507db68e747
SHA1

c35620ebf0e3c41b8851a8eb7f13c9e26a14a764
SHA256

412a4539502b7577f57e3a42c10738fb4d7bd3c6581129dd452da20e817a0f1a
SHA512

be0a22a0a3a26fb0dd49c688d9f9560699b5f32dc213781bb6b2fc42909df9b2f7173ce0b500bf4a22d9d0360727e15b267368639729dada23d3cfc6bb1f4c07
SSDEEP

1536:tZlDZ/rPNiONuOoFh3uXz1hgU9Evkc/EjisEn/0iVvPpQ1n/:nzhHoFh+X39lixn/0iNe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b5ae11e52244db3aa2ce507db68e747_JaffaCakes118

Files

2b5ae11e52244db3aa2ce507db68e747_JaffaCakes118
.exe windows:5 windows x86 arch:x86

999c6c515c50cf5a3681430a33984388

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strstr
NtMapViewOfSection
isprint
tolower
isspace
_snprintf
memset
memcpy
_chkstk
RtlUnwind
NtQueryVirtualMemory

kernel32

CreateProcessA
VirtualFree
CreateToolhelp32Snapshot
lstrcmpiW
Process32NextW
Process32FirstW
lstrcpyA
ExitProcess
MoveFileExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
lstrlenA
CreateFileA
GetLastError
DeviceIoControl
CloseHandle
GetThreadContext
SetThreadContext
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
TerminateProcess
GetSystemDirectoryA
GetProcAddress
VirtualAlloc
CreateFileMappingA
WriteProcessMemory
ResumeThread

user32

CharUpperBuffA

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

shell32

ShellExecuteA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE