344e2d6d5c94e9edecbaf4cb7fd737ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

344e2d6d5c94e9edecbaf4cb7fd737ed_JaffaCakes118
Size

9KB
MD5

344e2d6d5c94e9edecbaf4cb7fd737ed
SHA1

c321f648ab2ef6eafe3dc45a4594cb1ea042e9ec
SHA256

e75e8d1456491168e76523b0ce5d0210ceab90766df126f7044b6a073cccf7e5
SHA512

255d3faa23e2fa7a3e4e4682e34cba3c7f033a594479c2a121b73df8d9c7b96e98435eac2824b362ae82435e10a9aa52a161aa3be12653d909bc24fcf8705c61
SSDEEP

192:6jNNxUfE02FCaKr6XbLAirYEiZUXq6ijQ:SN8fE0SChmXTgZU/f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
344e2d6d5c94e9edecbaf4cb7fd737ed_JaffaCakes118

Files

344e2d6d5c94e9edecbaf4cb7fd737ed_JaffaCakes118
.exe windows:5 windows x86 arch:x86

767f20450f467c2a044020006c678251

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileA

kernel32

lstrcpyA
IsDebuggerPresent
ExitProcess
lstrlenA
CreateProcessA
lstrcatA
GetTempFileNameA
ContinueDebugEvent
WaitForDebugEvent
CloseHandle
GetTempPathA
DeleteFileA
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

user32

wsprintfA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ