88c854d43e7c6d9edae5a4dd8da82fbe_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

88c854d43e7c6d9edae5a4dd8da82fbe_JaffaCakes118
Size

60KB
MD5

88c854d43e7c6d9edae5a4dd8da82fbe
SHA1

4006fc4ad2136206b567b0fe2e4b8ee4cf849b31
SHA256

3b096174e26b012ccc483c7c6bb226fe3f23929b656007fb24b42ad89bba316c
SHA512

8fff44ff9017b6c443088e4137ecea8a868a68c8bb6e8dfb3c7b984542d06a500a68f13c000978a2d462a4aaa51c260ae989afcbe85eb132e8c2a465649f0ef7
SSDEEP

768:TPDKlIPhwTPf6oNNvcV9G6PNEcpg8pIKoZLCeu2/HoyF:TulIPYPSUO9G6PNHeAR6V/HPF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88c854d43e7c6d9edae5a4dd8da82fbe_JaffaCakes118

Files

88c854d43e7c6d9edae5a4dd8da82fbe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ce7ae3951ced605fd109259f7c58b38d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\inetpub\Temp\tts6mlhtnth5c5eo5vtcg7vri4\Stub.pdb

Imports

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
_controlfp
??3@YAXPAX@Z
memcpy

user32

LoadMenuA

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
WaitForSingleObject
CreateThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetProcAddress
VirtualFree
IsDebuggerPresent
UnhandledExceptionFilter

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ