30595982be97947cc008b7ed6ee403e7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30595982be97947cc008b7ed6ee403e7_JaffaCakes118
Size

11KB
MD5

30595982be97947cc008b7ed6ee403e7
SHA1

f10b2fd71f0556a2c071afa5eda3e45b88799290
SHA256

74de0ec027dd5ffff5ec4659873480d33fd6c5c6a1a9bfafbf91a0e44a10a63c
SHA512

027589c8fa83e80a2de11f6b40598c072ee441e255057de3bda41892030fd226b8737a70f83ca5c7c4f4e4cde9dee5128c40ca0ebcff032a1fb799dae5f0d1e9
SSDEEP

192:Yu4RCWrRXtRdhZo9b3hcG1zK6WrW9zbBTn/jVsFSYRR8+6WpA+:YRCWptRdhZ4xcG1zK6WrYH5Cu+6WpA+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30595982be97947cc008b7ed6ee403e7_JaffaCakes118

Files

30595982be97947cc008b7ed6ee403e7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8e0890cd29643509891174d00643b732

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

atl

AtlMarshalPtrInProc

ntdll

NtAddAtom

kernel32

SetLastError
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
GetCurrentProcessId
LoadLibraryW
GetCurrentThreadId
VirtualAlloc
GetTickCount
GetModuleHandleA
QueryPerformanceCounter

Sections

.textbss
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ