719dd8ab7b32231035940ff08bb3229c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

719dd8ab7b32231035940ff08bb3229c_JaffaCakes118
Size

66KB
MD5

719dd8ab7b32231035940ff08bb3229c
SHA1

2a62a9c6283fb3911b4a86541a19dd16686d7acc
SHA256

e10a20f4837bd68eb94cd09667c9e42bd3b678bd3cb6a580145864efd20c56b8
SHA512

f11f42c5e62f563728b98e02846099703d0c62e320a6a4eb75f4e572809791784bc7e66b7afecc44082ccdc5c4e26ddf0d0865d048ec5bb8237f63437c93e5cf
SSDEEP

768:CMzZpdPeB3urqJ8SH4GLu8H6iabx8v7Ae2T5+CjwxYut172hwXhEekfOw9:JzZpdPzrqdtLuBtu7A/dI7GwX4Ow9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
719dd8ab7b32231035940ff08bb3229c_JaffaCakes118

Files

719dd8ab7b32231035940ff08bb3229c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

89570a413037cd043ae163e652d7e40b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\VC5\release\unpack.pdb

Imports

ntdll

LdrFindResource_U
LdrAccessResource
wcscat
wcscpy
LdrFindEntryForAddress
wcslen
ZwAllocateVirtualMemory
ZwWriteVirtualMemory
ZwResumeThread
ZwDelayExecution
ZwClose
RtlInitUnicodeString
RtlPrefixUnicodeString
swprintf
RtlGetCurrentPeb
memset

kernel32

CreateProcessW
VirtualProtect
ExitProcess

Sections

.text
Size: 1024B - Virtual size: 738B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 762B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ