3cebcfa16a9dcef60d7492ce7a97733f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3cebcfa16a9dcef60d7492ce7a97733f_JaffaCakes118
Size

65KB
MD5

3cebcfa16a9dcef60d7492ce7a97733f
SHA1

fd1f61bd027384684cfb0cd96b724b8668ffbe71
SHA256

44a3c766e99bb64024f2835bc6ed45f3f5bf744cc9944bc05db8b2f416d980ec
SHA512

664585d4786923368ad4f813d901f99e3873f5c31dd3ce7a257b04916c25ba4c7fd1bf20703eb362f31cb28c86591b261222efdc90cfc375c50c18eb738757a2
SSDEEP

1536:sFbgcLZoWZ87Zd18Sn6DWoosgWlhaa8txBsM6ri:sFbgEoWYtsM6W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cebcfa16a9dcef60d7492ce7a97733f_JaffaCakes118

Files

3cebcfa16a9dcef60d7492ce7a97733f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d1f8be65e09776177d0eafdb316f8e5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
LoadLibraryA
lstrcmpiA
VirtualProtect
IsBadReadPtr
GetProcAddress
CreateThread
GetModuleHandleA

user32

DefWindowProcA
SendMessageA
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA

Exports

Exports

func1
func2
start

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 691B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ