87eb3ab9be9b5cd4446382d6b1217519_JaffaCakes118 | Triage

Sharing

General

Target

87eb3ab9be9b5cd4446382d6b1217519_JaffaCakes118
Size

164KB
MD5

87eb3ab9be9b5cd4446382d6b1217519
SHA1

c3d68b8fd361ce4b068cac2726618db61e25be3d
SHA256

e868e89ef9e71e5d47ef979eaab6436a07c6a0f1caa62dbd36ff6e97d96f2f29
SHA512

08203de4a34d16ad4566efb9768d1b52473330721eee7180fc3ab6c0669c71b929f5c8507a2373cd992d9e2ead5122f9c8710c9e1c4cfdb06dacdc96495b5f03
SSDEEP

3072:aO6k02fjbns0x2KQVslroeijMmWesTkW9XJWW4WdOUKVVZy5ceYjjSI:a52bnsW2KLlNveSkW9ZWW4MZMy5XsjSI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87eb3ab9be9b5cd4446382d6b1217519_JaffaCakes118

Files

87eb3ab9be9b5cd4446382d6b1217519_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fcfe2522091f449232b5b59807eb7715

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlGetFrame

kernel32

GetCurrentThreadId
GetCurrentProcessId
SearchPathW
GetSystemTimeAsFileTime
LeaveCriticalSection
ExpandEnvironmentStringsW

comctl32

ord17

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ