a7d134da9e66d84b026d71e5b921a399_JaffaCakes118 | Triage

Sharing

General

Target

a7d134da9e66d84b026d71e5b921a399_JaffaCakes118
Size

66KB
MD5

a7d134da9e66d84b026d71e5b921a399
SHA1

039b8265df3b5be96a5855f8146f69333300c839
SHA256

9b71db821341bf0754a3a0a715afd6f7104535f877df37ad866a353631118147
SHA512

dffa65a31088295f771f06dd405f709bff60f858830248fc127d398b5a32c11973995daa922f2bea2e8805d91a1baef2af6cf5b6b7725226859e51c06d581fc9
SSDEEP

768:ezZpdPeB3urqJ8SH4GLu8H6iabx8v7Ae2T5+CjwxYut172hwXhEekfOw9:ezZpdPzrqdtLuBtu7A/dI7GwX4Ow9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7d134da9e66d84b026d71e5b921a399_JaffaCakes118

Files

a7d134da9e66d84b026d71e5b921a399_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f27e0092d246eb9631be47b713d3be26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\VC5\release\unpack.pdb

Imports

ntdll

LdrFindResource_U
LdrAccessResource
wcscat
wcscpy
LdrFindEntryForAddress
wcslen
ZwAllocateVirtualMemory
ZwQueueApcThread
ZwResumeThread
ZwDelayExecution
ZwClose
RtlInitUnicodeString
RtlPrefixUnicodeString
swprintf
RtlGetCurrentPeb
memset

kernel32

CreateProcessW
VirtualProtect
ExitProcess

Sections

.text
Size: 1024B - Virtual size: 738B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ