7133ebb3e76b19263dd19fd5f56682f2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7133ebb3e76b19263dd19fd5f56682f2_JaffaCakes118
Size

84KB
MD5

7133ebb3e76b19263dd19fd5f56682f2
SHA1

cd91822aa548cdd758d5ce6952e1dc53416158cf
SHA256

17530335698d524c86af1946c8a3e1cc0067c86239db9e11bf639d2f7c8bdb28
SHA512

92e927a12a4cb4be62e5c2a2413d8e479f2e009987629102182d5cbb72205bbba67d9749e46c09855337d1312eb1fdd658c5a770f60e72eb009f9bbc3db5262c
SSDEEP

1536:aV2m3iM3MimyL9cq+M6TQxxqygBTrXFCHiqqAfKDSTIh5PWsdAc9ium4oV1uJc:W2m3hNmyL9cvM6TQuyaTEbslh5PjguK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7133ebb3e76b19263dd19fd5f56682f2_JaffaCakes118

Files

7133ebb3e76b19263dd19fd5f56682f2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

04dc71e401e27b475710d9e2d842ce4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

InterlockedDecrement
Sleep
SwitchToThread
VirtualAllocEx
CloseHandle

ntdll

NtCreateTimer
ZwCreateEvent
ZwClose
NtSetTimer

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ