3082c1a7e3beadd5afd939ea328f3d7a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3082c1a7e3beadd5afd939ea328f3d7a_JaffaCakes118
Size

101KB
MD5

3082c1a7e3beadd5afd939ea328f3d7a
SHA1

c0c327650f731415fc75af481687a0055a7460ba
SHA256

566efe766249d79328a796406fa56072632cb7464ee0d58f1643893767316f61
SHA512

eac99cdb1f0ddc17e4d2e5aa782a9028f646b062962c045e4e6ca9db4f55d7662329c8b692e0aaaf2fcd3cc5ee4919c05320cf5fa2bb2a3274521a9574c624f8
SSDEEP

3072:uxhamTS9vKSIz+8YBjUykdcrUfsfA6EEX3hLas:uxhamMg7YMass48RGs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3082c1a7e3beadd5afd939ea328f3d7a_JaffaCakes118

Files

3082c1a7e3beadd5afd939ea328f3d7a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

748fbb4e210c108426b82463c786b5f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetProcessVersion
MoveFileA
VirtualProtectEx
ExitProcess

ntdll

ZwConnectPort
RtlEqualUnicodeString
NtSetDefaultUILanguage
ZwMapUserPhysicalPagesScatter

user32

CharUpperA
CheckMenuItem
EmptyClipboard
DeferWindowPos

Exports

Exports

CreateRofgprs
Igrtagwbi
Vtakqnvd
Meiwanxpsi

Sections

.text
Size: 4KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lrslr
Size: 93KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ