31ee0ff69aa7b06f20263af3987f6230_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31ee0ff69aa7b06f20263af3987f6230_JaffaCakes118
Size

35KB
MD5

31ee0ff69aa7b06f20263af3987f6230
SHA1

ffe51960821f095334204d96a88b5437ef367d18
SHA256

49c9deb6fd3ed45b7399039d301143ac42034be54b67bd5ea42a5014c1d4a0f6
SHA512

995afe52ef01b995b50af493aa3821b4abb40908d67685c4d049cdc06884544b5d77998ae590cf3f735ea9efde0984c338fce909c91ee02e627cd287d3c32852
SSDEEP

768:t7jMEXNPDzbRT5qVdNEtzvWIBwnaFqmh4y7GtPa36a0B4YE0wltm4t:tndXNPDzbRT5qVXEtzvWIBWaQI4y7kjk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31ee0ff69aa7b06f20263af3987f6230_JaffaCakes118

Files

31ee0ff69aa7b06f20263af3987f6230_JaffaCakes118
.exe windows:5 windows x86 arch:x86

425c043813b0ea9c6d4093878c9e9164

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dmremote.pdb

Imports

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__getmainargs
_except_handler3
_controlfp
??2@YAPAXI@Z
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
??3@YAXPAX@Z
__set_app_type

kernel32

InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
GetCurrentThreadId

user32

DispatchMessageW
GetMessageW
PostThreadMessageW

ole32

CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoInitializeSecurity
CoInitializeEx
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstanceEx
CoTaskMemAlloc
CoTaskMemFree

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE