5b488d456a66246017fc9ab368d89b9e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b488d456a66246017fc9ab368d89b9e_JaffaCakes118
Size

83KB
MD5

5b488d456a66246017fc9ab368d89b9e
SHA1

e01cf158594c3a19424b14825d83143c3dd916ee
SHA256

08224e12fad237f76880ba7bab8789f6b6e93c15584bd64c16b95f4e4adb5553
SHA512

af82452cfdea989612937b836df176e09a82f9b8a3a59f3619f24ce9a7232e1ec0872aec34ecc8a20a976f791d5b65b68479528fdedc883294d0b566b78e1979
SSDEEP

1536:rgXCmEMdS6MUiXvDf7MTXlqH7XAvW4P41v4ikFZj:rgXCmVw6MJbfe9FZj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b488d456a66246017fc9ab368d89b9e_JaffaCakes118

Files

5b488d456a66246017fc9ab368d89b9e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc8e5f8a150e46d9320b428746f0fc3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
FreeLibrary
GetTempFileNameA
CloseHandle
GetModuleHandleA
lstrcmpiA
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

ZwConnectPort
RtlTimeToSecondsSince1970
atan
RtlCreateUserProcess
RtlCreateQueryDebugBuffer
ZwCancelTimer
RtlUnicodeToMultiByteSize
ZwQuerySymbolicLinkObject
NtQueryInformationPort
NtOpenProcess
KiUserApcDispatcher
PfxRemovePrefix
RtlRunDecodeUnicodeString
NtGetDevicePowerState
_chkstk
ZwCompleteConnectPort

Exports

Exports

GetUynuvxahs

Sections

.nk90
Size: 4KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_PAGELK
Size: 75KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ