8b26f09e3396e70957b30ffcb2fc5282_JaffaCakes118 | Triage

Sharing

General

Target

8b26f09e3396e70957b30ffcb2fc5282_JaffaCakes118
Size

41KB
MD5

8b26f09e3396e70957b30ffcb2fc5282
SHA1

5aff65b9b45116ec4b49aeef468ac1ad308bd629
SHA256

dd9d13200c0be0631e9dabd0f79aef086a7570a396524002d3cc2d51f4e7dc88
SHA512

7320aa916d93c1a6b67965dff054cce45e0b70b6d59de3194944b70959b394f35c05193b2571021d941892ff9a4fbdbff56af20282a5cb54edea4f8ec3f64dae
SSDEEP

768:A70KhfSS43IYQTHDkUvfSgGEayfbe4mixDxN3KFXnjaxAQ7orSvpAvCgWq:AnKX3DQTHDkUvagGEnDeB0xlKFXjFQ7s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b26f09e3396e70957b30ffcb2fc5282_JaffaCakes118

Files

8b26f09e3396e70957b30ffcb2fc5282_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fb13ca5f89c4959372ad4b33a77a50f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrA

kernel32

VirtualFree
GetStartupInfoA
GetFileAttributesExA
CloseHandle
Sleep
ReadFile
SetFilePointer
CreateFileA
ExitProcess
GetModuleFileNameA
GetProcessId
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAlloc
VirtualProtect
GetCommandLineA
GetProcAddress
LoadLibraryA
IsBadReadPtr
lstrcmpiA
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
GetModuleHandleA
HeapReAlloc

user32

wvsprintfA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE