9717e6d1890fc49d69c37c747a01858c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9717e6d1890fc49d69c37c747a01858c_JaffaCakes118
Size

179KB
MD5

9717e6d1890fc49d69c37c747a01858c
SHA1

d51d9f85a15c8e0631ad629e179d5ed4d3222f8e
SHA256

04f2dbb7405a79a8a4e9cfaea0df74db8400770a3d6ca01e849cf81092efed74
SHA512

9598216f537dd27581d3a9332b7530822257cf97fe9bcba392791b0223d74ce6f9eebcc26dbe84081dcaadb735352faa1be9f1602fc0925baf971496295c4eaf
SSDEEP

3072:EXc0QnDkzTBfV416BjBNGgM085vYkljCuDdofYRxYv0sSpMU4HBKlZ:tDkfBtUGcwHnSh4H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9717e6d1890fc49d69c37c747a01858c_JaffaCakes118

Files

9717e6d1890fc49d69c37c747a01858c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ef3a0c6b6b4f845864cd9e2b781d9c93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
AddAtomA
ExitProcess
ReadFile
SetErrorMode
GetProcAddress
GetModuleHandleA
HeapReAlloc
HeapAlloc
GetCommandLineA
GetProcessHeap

user32

MessageBoxA

Sections

.text2
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ