3a2b325ba47955f92f1c8f96e91805a5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a2b325ba47955f92f1c8f96e91805a5_JaffaCakes118
Size

121KB
MD5

3a2b325ba47955f92f1c8f96e91805a5
SHA1

21eebf2c3d4b40d12e6ea91464cd89b9ed3bd8a5
SHA256

9f00d7a90880682e24cdd3eb66a2cb966417413b5cbce628812bef21da9d6f85
SHA512

cfdeeed09f8b02430042efa48a85ce65bf91aca9418d610aba638487a612b63bb51621669fbac2e5979f2dc26b9dcc0d9ab6f0e2f4f31b8d9a0dfe3704715284
SSDEEP

3072:G9/HNjIoauoYRSAwbNIfxtaswjvpzCuRYnfTDx3:C/HzalqS/Cxt2zYnfJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a2b325ba47955f92f1c8f96e91805a5_JaffaCakes118

Files

3a2b325ba47955f92f1c8f96e91805a5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

442f40746d8defaa39948ae47694c48b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\tmp\test.pdb

Imports

kernel32

GetVersionExA
CreateThread
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
Sleep
GetTickCount
RtlUnwind
TerminateProcess

user32

MessageBoxA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 466B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ