34c175882a891e9d0cfae54129030e11_JaffaCakes118 | Triage

Sharing

General

Target

34c175882a891e9d0cfae54129030e11_JaffaCakes118
Size

1.2MB
MD5

34c175882a891e9d0cfae54129030e11
SHA1

2fdca85db718a856caf5c16ad843f44e336366f5
SHA256

98710e236747a3e48a556e5d7224e7771606df1c056691aafbe15c69d92f2cbb
SHA512

5baf491d1a77a9f1d8ce8281410aa72214cf1215385d7cf262cb0a031a5d2c61d0ec9a3639cf37efbbe57f07715c6b63d6733255ecbc768aa4b66286b686f3ac
SSDEEP

24576:LgxYhwXwhTdk4lTCc1GGVLsoRZ05mB0H3Cmpq5JDoQAaVCFkJM:LEYhwXC7mGpsoRZeSQq5J6aVAkJM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34c175882a891e9d0cfae54129030e11_JaffaCakes118

Files

34c175882a891e9d0cfae54129030e11_JaffaCakes118
.exe windows:5 windows x86 arch:x86

cbf47572e8cb446c01bd5522c7d7f827

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\LinkLines\Release\LinkLines.pdb

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
lstrcpynW
GetFullPathNameW
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
WideCharToMultiByte
GetEnvironmentVariableW
GetVersion

user32

MessageBoxA

Sections

.text
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 96B - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE