65404679ba0190adecf57cc6844e3a22_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65404679ba0190adecf57cc6844e3a22_JaffaCakes118
Size

9KB
MD5

65404679ba0190adecf57cc6844e3a22
SHA1

b756464063a88e810fb517b8af05ebe31c615b2f
SHA256

caa27ddc869652d67d228698e4437f98302f088563528ed662fd94f19e46c411
SHA512

933baa78d2dd1d9a246df8b2d12f72bbec8f0e8b2e1980bbbc8c642d670bde353811d8cacb80ef898a85873db8cb8b94d27e4a66191d98b23534d101248ffcec
SSDEEP

192:rsI4f4aSTESRID+e4P1oyP4YugUPgWU/sZpelQX5gffz:rIQTu+eu12MWWsMQX5gf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65404679ba0190adecf57cc6844e3a22_JaffaCakes118

Files

65404679ba0190adecf57cc6844e3a22_JaffaCakes118
.exe windows:5 windows x86 arch:x86

404939d7ef9c427018bfda310a01e2cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strcpy
memset
memcpy
strncpy
RtlUnwind
strcat

kernel32

GetStartupInfoA
HeapAlloc
GetEnvironmentVariableA
GetTempPathA
WriteFile
HeapFree
GetModuleHandleA
GetTickCount
OpenEventA
Sleep
CloseHandle

msvcrt

_initterm
_controlfp
__set_app_type
__p__fmode
_exit
_XcptFilter
exit
_acmdln
__getmainargs
__p__commode
__setusermatherr
_adjust_fdiv

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ