357d0725ce0eaabca8b58c570e35deb1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

357d0725ce0eaabca8b58c570e35deb1_JaffaCakes118
Size

191KB
MD5

357d0725ce0eaabca8b58c570e35deb1
SHA1

40ad43629b07a65051802dbd35106094917d0e32
SHA256

223267f49102fcd3795aaf5cf08c4f61f29035ca0280d0d800b9aa4c284a7b82
SHA512

12b308fa3ec1d89fe1048690c7c5ddbe88fafd814f926da4d5e6fdaf95e1217b979986181eb6fd5da5fd350ff8292e55e39bb86898f36f24f2e2aa4353d3bc52
SSDEEP

3072:RVG9vZqfJz5RpYmlZKBgL6yIVVGk2PCSGZy2z6ygD8JRmPDasXG/q:jGF2zYS2gL6yIVEk2KSGw178J4bd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
357d0725ce0eaabca8b58c570e35deb1_JaffaCakes118

Files

357d0725ce0eaabca8b58c570e35deb1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

87604b9ea833c4483b73cd954f8f2f9a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentThread
VirtualQuery
VirtualProtectEx
ExitProcess

ntdll

NtReadFile

user32

DestroyCaret
GetActiveWindow

Sections

.ntext
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cwhiwd
Size: - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buhdhq
Size: 183KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tdata
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ