6506967caad478d346e64bb0823d0d99_JaffaCakes118 | Triage

Sharing

General

Target

6506967caad478d346e64bb0823d0d99_JaffaCakes118
Size

17KB
MD5

6506967caad478d346e64bb0823d0d99
SHA1

04030dde540e40fcf0394c3faa8c5eb905c5f041
SHA256

41ced64a0ed34c2b871a1dcb5befaf6f6fc75411b181f9fe3272edd88eed0d01
SHA512

e164a3e0f3b41efd5c74bcdeb3aaa5b53603660161c0ec274358a24c2c050e3948e1ac41a05fe77174bd581d32233a3679d65106d9254ddd577cb632038fce5d
SSDEEP

384:mc0hmHoOOdDOpbA0EICjw7eLDe0FCSdlmQx4Robs7D/cISwO+s/drNHFgB+:OMIOn+e7eLfFz3mQx417ywO+s/dxHS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6506967caad478d346e64bb0823d0d99_JaffaCakes118

Files

6506967caad478d346e64bb0823d0d99_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4582ffdd7eb98cb63a937096204182b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\XRoot_Build\X7.0\Vm\Release\x86\StubExe.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
GetCurrentProcessId
OpenFileMappingW
GetLastError
MapViewOfFile
CloseHandle
CreateFileW
CreateFileMappingW
UnmapViewOfFile
GetFileInformationByHandle
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
LoadLibraryW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ