34eeef437582f12608ea9049ec184839_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

34eeef437582f12608ea9049ec184839_JaffaCakes118
Size

81KB
MD5

34eeef437582f12608ea9049ec184839
SHA1

21123458bbbd8d2b3e21bf7228b1721eeaec7ef4
SHA256

6dfc012a9fc9598119a2de768d0823b6c6d43d55db92655a568c798d5c0368bc
SHA512

8697ace29e89a08ff914a06ca06c4597e70b07ae6c80cdfd4ae979e05cad1a72bafb6615ec3b3640f578ec3f68979c1d2e02f5ec10847365993fee0c1e13d8fd
SSDEEP

1536:/CkgQjauFr3qLseS8bClLiXTQOCLG8EG48xE7Fd3YcMCA2awNS:/ngQLFraIexKs0O6CGxxEhdocvS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34eeef437582f12608ea9049ec184839_JaffaCakes118

Files

34eeef437582f12608ea9049ec184839_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a2c754fae10add008256dda52e4fe58e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
ExitProcess
SetPriorityClass
VirtualProtectEx
GetModuleHandleA
GetStartupInfoA
GetModuleFileNameA

user32

BeginPaint
GetUserObjectInformationA

Exports

Exports

GetVjlgygqjm
Lfriovabq

Sections

.text
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rcode
Size: 544B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata1
Size: 67KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ