6160ed331c7e02d7fbc026665a3494c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6160ed331c7e02d7fbc026665a3494c1_JaffaCakes118
Size

8KB
MD5

6160ed331c7e02d7fbc026665a3494c1
SHA1

39ecd2454336f287d08a9dae8fdbdab037e840d3
SHA256

4a713c6e43eee63fa62ab64cebdfbcdd2e99e57ae245573a421063e84716efdf
SHA512

cdd157e0bafc2755192f2d827fe886b5506365161ced45d41e72b321744ea7780bb51bf006a65265ac26b939ac350ebd4e610f3edc84a021ced8cf6669ce76af
SSDEEP

192:bfHJhDJfWJa3PfXpoKcHkxWED/BPodIb/s:bTDJfsYH5Tyit/BTg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6160ed331c7e02d7fbc026665a3494c1_JaffaCakes118

Files

6160ed331c7e02d7fbc026665a3494c1_JaffaCakes118
.exe windows:6 windows x86 arch:x86

eb396797b13ef3fc090adafa7654ae9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\huanghai_localcode\pnpnew\resetdevice\objfre_w2k_x86\i386\ResetDevice.pdb

Imports

kernel32

CloseHandle
Sleep
DeviceIoControl
CreateFileA
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
UnhandledExceptionFilter

msvcrt

__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
memset
atoi
_vsnprintf
__p__commode

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE