974e8bc2cf98cb9c26d47f475089a309_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

974e8bc2cf98cb9c26d47f475089a309_JaffaCakes118
Size

126KB
MD5

974e8bc2cf98cb9c26d47f475089a309
SHA1

f81105edda141dd20f5b2b4d1984d9ec215ec6a9
SHA256

a69a5407dbb603b1befb5fc10bd82c14b6b3227319d9bcaa5eff30b05cdbbe1a
SHA512

54c878a931b3501a3d1a8666560acb61f04b4cd49f1c062318c57bc066f7a449ec0dbc8e9a944790b25930455a16559c1d685966da75cf5368dacb304686aff9
SSDEEP

3072:giBAyIuO8oUlnRcSiVCUixtjx6HtpdPzb:F7IuOvOncVC/CzJzb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
974e8bc2cf98cb9c26d47f475089a309_JaffaCakes118

Files

974e8bc2cf98cb9c26d47f475089a309_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2ba6438a5cf3d526f8b41f260938957a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlComputeCrc32
RtlImageDirectoryEntryToData
RtlUnwind
NtQueryVirtualMemory

kernel32

SearchPathW
ExpandEnvironmentStringsW
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
LeaveCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW

comctl32

ord17

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ