36c854a8fbde9028898a8c145d325152_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36c854a8fbde9028898a8c145d325152_JaffaCakes118
Size

63KB
MD5

36c854a8fbde9028898a8c145d325152
SHA1

935f171df389e8915599e19243cfade3f1e7eb6e
SHA256

31f218d5013ffabf00f740ab144525ba0c3568a52b6c59a48d86831c8e773168
SHA512

349d60e93ef8a0be1129bbca7b38d99d84fc7e19ae6732ffe6cc3b710f693ccd166bb290f2080fcdab050ff4d036ac1958859722f686df565096436843923d57
SSDEEP

1536:ceTaF8BsaRz9HFtfrDtn/yBKlRi/anC/68WtlRVP:coBHFtfPtn6BKlRA6dRB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36c854a8fbde9028898a8c145d325152_JaffaCakes118

Files

36c854a8fbde9028898a8c145d325152_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a6913392711ccdbad10a629bc41824f5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessInternalWSecure
RegisterConsoleOS2
FindFirstFileExW
EnumUILanguagesW
FindNextVolumeW
OpenEventW
lstrcmpiA
OpenFileMappingW
LZClose
HeapExtend
GetVolumePathNamesForVolumeNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE