356e8fee2ab00ece101cd9b5f90803fc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

356e8fee2ab00ece101cd9b5f90803fc_JaffaCakes118
Size

16KB
MD5

356e8fee2ab00ece101cd9b5f90803fc
SHA1

97a9f538b39dcbed5eba2e1005ff991001feae6e
SHA256

87c5f83c5ea647ec09132b82e948f67daf40af7167295490caad9b82f5b933a5
SHA512

9e6c88957cb20fc37b2bb10286f833106d30a973527c03dbecbd5cdb83881c6cde2eec63f844dd4527ebf45b38c6f66520e1599163008d9f97999b1941ad14fd
SSDEEP

96:P5DB2D+28MynsAZuPHZxfDWPto5H3oPtboyKL:P5DB2z8KAW5YEoP1oy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
356e8fee2ab00ece101cd9b5f90803fc_JaffaCakes118

Files

356e8fee2ab00ece101cd9b5f90803fc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

68d436bea40c43806584d6b891dccde6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
GetFileSize
CreateFileA
Sleep
LocalFree
VirtualUnlock
ReadFile
GetCurrentThread
VirtualLock
MapViewOfFile
SetProcessAffinityMask
GetProcessAffinityMask
GetCurrentProcess
CloseHandle
GetModuleHandleA
SetThreadPriority
GetProcAddress
GetStartupInfoA

advapi32

SetEntriesInAclA
SetSecurityInfo
GetSecurityInfo

ntdll

RtlUnwind
RtlInitUnicodeString
ZwOpenSection
ZwClose
_stricmp

msvcrt

_initterm
_controlfp
free
malloc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
__set_app_type
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE