2d1691e4568dd8e9b3dfeed5101b3218_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d1691e4568dd8e9b3dfeed5101b3218_JaffaCakes118
Size

66KB
MD5

2d1691e4568dd8e9b3dfeed5101b3218
SHA1

f2bc8b14dd00c83ae21b252f65cb598149eed64c
SHA256

92cfea45bfe248dbaf39bd82b8b359148abf279c5033609fea66ec858608109f
SHA512

1ed9268e245c787d8f3a7e024fde4e3c23e6a33b1544e9331fd5ddc0839dea4634aa81c6fcf767e08def8e42abcb6123a1ced44336122f2eeea1168836014cbf
SSDEEP

768:uzZpdPeB3urqJ8SH4GLu8H6iabx8v7Ae2T5+CjwxYut172hwXhEekfOw9:uzZpdPzrqdtLuBtu7A/dI7GwX4Ow9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d1691e4568dd8e9b3dfeed5101b3218_JaffaCakes118

Files

2d1691e4568dd8e9b3dfeed5101b3218_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7255ebac48abcec982834fedc9782030

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\VC5\release\unpack.pdb

Imports

ntdll

wcscat
wcscpy
LdrFindEntryForAddress
swprintf
ZwAllocateVirtualMemory
LdrAccessResource
ZwQueueApcThread
ZwResumeThread
ZwDelayExecution
ZwClose
LdrFindResource_U
wcslen
RtlInitUnicodeString
RtlPrefixUnicodeString
ZwWriteVirtualMemory
RtlGetCurrentPeb
memset

kernel32

ExitProcess
CreateProcessW
VirtualProtect

user32

MessageBoxW

Sections

.text
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 842B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ