769ed2b8d5df73dfb46421a6d1218502_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

769ed2b8d5df73dfb46421a6d1218502_JaffaCakes118
Size

108KB
MD5

769ed2b8d5df73dfb46421a6d1218502
SHA1

6a0976a206b993bac4a34f866dde8043439de905
SHA256

1f8691431eb27483211b292e36302170c92a07c597309bee0ed5266cf5ff0b33
SHA512

13dfc314c4e5ac5b9eb17f7b3f687a7761d05a665e2efc3e3eafba3658ea98f3d16704e260c008b9f3809c76a8854adbd51abe0f41af8b565936e0c8dfa9182e
SSDEEP

3072:WwzcWd8UkAFvJ5BpAvdvGL7bBmbyEK3TDd8:WicWdZidvWC+O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
769ed2b8d5df73dfb46421a6d1218502_JaffaCakes118

Files

769ed2b8d5df73dfb46421a6d1218502_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0227fb3e8589b8bfa4500b84d5209d35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlFindLongestRunClear
DbgUiConnectToDbg
wcscat
NtReleaseMutant
NtQueryDefaultLocale
NtQueryInformationThread
RtlDeleteTimerQueue
ZwReleaseMutant
NtSetSystemPowerState

kernel32

Sleep
GetSystemTimeAsFileTime
GetModuleHandleA
GetTickCount
FormatMessageA
GetCurrentThreadId
ExitProcess
GetLastError
GetCommandLineA
lstrcpynA
IsBadStringPtrW

msvcrt

wcsncpy
_splitpath
_isctype
bsearch
_snwprintf
realloc

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE