36e97f89089dd7904176e22f0a3e0632_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36e97f89089dd7904176e22f0a3e0632_JaffaCakes118
Size

41KB
MD5

36e97f89089dd7904176e22f0a3e0632
SHA1

4d501155e44f280fd16a1dcc174cc508377ebd2d
SHA256

6f4bbdc9f299fbe73a42f20700cf4c89816dff313b4fa3975a987afe00b5818c
SHA512

189b505365a249426d9b944b8036b003a7f9f2ca8f6a63805a89c7abf7e293fa1340a88c2fc07baf6fc115efc61bfb07e9af48baf9bc21dca9f61ec852d159ae
SSDEEP

768:Fg5+jSdpQRqSAhg9UePIsdCigplxQSOp:iuSdqRdAFePI+gplxQS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36e97f89089dd7904176e22f0a3e0632_JaffaCakes118

Files

36e97f89089dd7904176e22f0a3e0632_JaffaCakes118
.exe windows:4 windows x86 arch:x86

73f5e19cfc1a907a49cae3f2366dd099

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetCurrentProcess
LoadLibraryA
GetPrivateProfileStructA
WritePrivateProfileStringW
VDMConsoleOperation
DnsHostnameToComputerNameW
SetProcessAffinityMask
GetLastError
EnumLanguageGroupLocalesW
OpenConsoleW
VirtualProtectEx
CreateHardLinkW
GetProcAddress
EnumResourceTypesA

user32

SetCapture

Sections

.text
Size: 4KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE