3976be148aabf4e487ad635e2ecd0b84_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3976be148aabf4e487ad635e2ecd0b84_JaffaCakes118
Size

77KB
MD5

3976be148aabf4e487ad635e2ecd0b84
SHA1

178a7a826f62dfddc0181be5858711503f909402
SHA256

a66c2a37c865c31fae2b112594404ceb200e1c756954c919ce76122ee06bf7ad
SHA512

76cbd534d931c228f6d36de6b9ba9bdf6a2f6d86b726c91a632c7a70751392b7ab6746d1f8ca5dcc2670e7acbea3e011ad689b53ca345d9fca64bc611678afb5
SSDEEP

1536:Cnoewu6JpwSuAzOsXPNjykLGTLfjf1KDKL/9+s20mRuYWLjPVu:0Zwu6D6FwNBLUbfUDKLsluYW3Vu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3976be148aabf4e487ad635e2ecd0b84_JaffaCakes118

Files

3976be148aabf4e487ad635e2ecd0b84_JaffaCakes118
.exe windows:4 windows x86 arch:x86

df03cdcd31346a5133a1319d89165224

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

OpenFile
TerminateThread
VirtualProtect

shlwapi

IsCharSpaceW
ChrCmpIW
StrCatW

Sections

.text
Size: 41KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ