a2453a078d670b3e1f8caf7b579ae702_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a2453a078d670b3e1f8caf7b579ae702_JaffaCakes118
Size

116KB
MD5

a2453a078d670b3e1f8caf7b579ae702
SHA1

0c6bece92710e1ed15f6826f0b2ea6f4f46c94a5
SHA256

623a6b0e69f0546470bc5a08e379a7089e0040c24d52d6f3cb4ef93f44ffa92e
SHA512

81f7fd800e7e09ea83a63aff9302a5dbe36691ad7ee9769446ee4ba943c593dfb9b57bddeda006fb2563f6874ca8bc8cfb3132c4a06427f290698f79371fa1e7
SSDEEP

3072:LrYsaRoDIx6z6UBdTTgD05wCG5eG/npVu:LlGIjFgD0qCkeG/nu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2453a078d670b3e1f8caf7b579ae702_JaffaCakes118

Files

a2453a078d670b3e1f8caf7b579ae702_JaffaCakes118
.exe windows:5 windows x86 arch:x86

22f53f1fa83a2f2bd3fae3695a65a786

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetProcessHeap
VirtualFree
lstrcmpiW
Sleep
ExitProcess

user32

GetDesktopWindow

Sections

.text
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Fyndk, U
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Psbnps S
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Wragopgy
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 259B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ