960e5a64d601d5ea890ae98a226ed51b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

960e5a64d601d5ea890ae98a226ed51b_JaffaCakes118
Size

83KB
MD5

960e5a64d601d5ea890ae98a226ed51b
SHA1

42f93282b156eadae16f27924fb35983639d3467
SHA256

f6690f8eb9aa65cf14fbc17ba28eef832db369bd408f56612068aad472ef6c06
SHA512

f8e4cfac14918fd542874e746cfb2dd1783ee14d4ad9e5d0c4fbab769ff8ed9fef3f20f7fdb89ef454a0b51f38dea31b4b22d272034e97beb2a2e9d802404b06
SSDEEP

1536:2OBWmRkEPcWCsFEJxCGWKfdsWY01y4CPe3wfx+pm1JnDTHleM8lYs:LMmaE0Wp+WgGZ0bCPe3Hp0DTHlWas

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
960e5a64d601d5ea890ae98a226ed51b_JaffaCakes118

Files

960e5a64d601d5ea890ae98a226ed51b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cefd254c905ff26b589182d0cfcd1288

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetModuleHandleA
MultiByteToWideChar
CloseHandle
WTSGetActiveConsoleSessionId
GetStartupInfoA

advapi32

CreateProcessAsUserW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA
WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
LoadUserProfileA
UnloadUserProfile

msvcrt

_acmdln
_controlfp
_except_handler3
__set_app_type
__p__fmode
memset
__p__commode
_exit
_XcptFilter
exit
calloc
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv

Sections

.rdata
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ