01de3caebd422e1072592b500fb78a52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01de3caebd422e1072592b500fb78a52_JaffaCakes118
Size

177KB
MD5

01de3caebd422e1072592b500fb78a52
SHA1

7c4df76b7a21173c5ef66989e62c8e38c3a1e2a3
SHA256

1c919c9568e726a76fb1e50d356d887c7d9e3deb7060d65105438cddb1b5a5db
SHA512

93747aed0152b3fa0077cf0b9e792ae79c659299efc77592d03234c5fa93f9fb175fc8190c1ab8ee13e433948857a507e3134f6d95220a038c2f65d29529e9ba
SSDEEP

3072:Q4a8rnzddb/FfSgAr1AcHaiVNmwOlHESvszx7J1wj3OFrxMXCrQ9CZ/47yt4:Q4HrzdxIRn6iVNmwcEBF+3exMyrLuyt4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01de3caebd422e1072592b500fb78a52_JaffaCakes118

Files

01de3caebd422e1072592b500fb78a52_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c83c712901a598bda2efa84db54f312f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlZeroMemory
memcpy

powrprof

IsPwrShutdownAllowed

kernel32

GetModuleHandleA
GetModuleFileNameW
ExitProcess
GetCommandLineW
GetModuleHandleW

user32

PostQuitMessage
EndDialog
LoadStringW
EndPaint
FindWindowA
BeginPaint
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
DialogBoxParamW
DestroyWindow
DefWindowProcW

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ