70b59b251312fb5f0d51ff4138b34502_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70b59b251312fb5f0d51ff4138b34502_JaffaCakes118
Size

113KB
MD5

70b59b251312fb5f0d51ff4138b34502
SHA1

7795b493a19849db409c173b4d78ade372ba664f
SHA256

c9faf41a0478d1d094637a6b070819ae3900e7fd720fc1ebedecb977458170e0
SHA512

bb888a2d52f8e5ba60a6b57c500303b5dfa40e49d5c871d7ab1c49d9b189ec53f356965889145ba972f5d42ca61331d90ceef3f1384f1415e661cca37a40cb56
SSDEEP

1536:3PaurquFwq/kMPPMjx1yzGBDFr+ISzXNViHA2vz9yHYg2jlWyZ:fauquFwqMMPPMi6r+JzXNVixg2jQy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70b59b251312fb5f0d51ff4138b34502_JaffaCakes118

Files

70b59b251312fb5f0d51ff4138b34502_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5c3d8ba5552140e023669de81d17d514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
CopyFileA
GetCommandLineA
VirtualFree
Sleep
ExitProcess

user32

GetMessagePos

winmm

timeSetEvent

comctl32

InitCommonControls

Sections

.text
Size: 512B - Virtual size: 234B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE