35a11448a7e6a32a3d16f41cc49a7c67_JaffaCakes118 | Triage

Sharing

General

Target

35a11448a7e6a32a3d16f41cc49a7c67_JaffaCakes118
Size

34KB
MD5

35a11448a7e6a32a3d16f41cc49a7c67
SHA1

3426c268aa54e8906d41e55945c57a0fce2da68d
SHA256

2e6257d1bff34e9541214608937d83ac836319e798e12d63528148fc8228dc2d
SHA512

9f1b494511d6d417b50d292868b14dcddad7101677d5e0c2a7b1ad0e855dc615022a51d0799ccabf3ea9ef7edcdd822d39bb77bee48af35ecd338db4d4af66e3
SSDEEP

768:zeE7wTjo/2FG7B/oezmkK0QL+f0YmuguHE2UMO:zeEMO7B/oezm0QS0udUMO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35a11448a7e6a32a3d16f41cc49a7c67_JaffaCakes118

Files

35a11448a7e6a32a3d16f41cc49a7c67_JaffaCakes118
.exe windows:4 windows x86 arch:x86

697e8622707d3d53f17b01b0e39d0f59

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetFileSize
FindResourceA
FreeResource
MapViewOfFile
UnmapViewOfFile
LoadResource
Process32First
SleepEx
GetCommandLineA
SizeofResource
lstrcatA
lstrcmpiA
QueueUserAPC
Process32Next
WritePrivateProfileStringA
GetModuleHandleA
IsDebuggerPresent
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
CreateThread
lstrcpyA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ