3f18166f52a29b68faaac1c3dc4dd469_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f18166f52a29b68faaac1c3dc4dd469_JaffaCakes118
Size

10KB
MD5

3f18166f52a29b68faaac1c3dc4dd469
SHA1

8cbf4a67638deac50d7d3935f8d1f3e965cd7146
SHA256

7423956470773e40ff05666a54feaf45b2d0af7d21f2816666884ba275590fcb
SHA512

de11e144f6a020dedaf8169f3ea61314eb53bf9e96f4437d8c35975808750a5f1b061f0a80ccd08c8d41c0cb07bdc6fb137920cfb45956db61b6da94908cd195
SSDEEP

192:77vRCQZtUJJbccHpOzDd+cuP1oynwPGO:zUJTHpOV+cY1qPG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f18166f52a29b68faaac1c3dc4dd469_JaffaCakes118

Files

3f18166f52a29b68faaac1c3dc4dd469_JaffaCakes118
.exe windows:5 windows x86 arch:x86

442ca733a3b7d78f1b442be17ee504bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
_onexit
memcpy
memset
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
??3@YAXPAX@Z
__dllonexit
_stricmp

psapi

GetModuleFileNameExW

kernel32

GetModuleHandleA
ResumeThread
WriteProcessMemory
IsDebuggerPresent
VirtualAllocEx
GetProcAddress
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
GetStartupInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ