ad738fd7090dad85f0f26f85241d5d30_JaffaCakes118 | Triage

Sharing

General

Target

ad738fd7090dad85f0f26f85241d5d30_JaffaCakes118
Size

228KB
MD5

ad738fd7090dad85f0f26f85241d5d30
SHA1

0e961159f115298734d4a4aaac756b0fd51faff5
SHA256

536cf5a0fb4cda7daf71c71a1ecc38489e9affff8c9082239379c2eec7768564
SHA512

7d2238fe8f3640e38981b15986a6e45e8465c471ec6f1a038a9dc21fffd21df3d5b051ab9c0b916b0ed7b306ce827b95dce8a5d398ae2076b344d02d7e0f88af
SSDEEP

3072:FQUO8l7IdJ0keY1TStZGE5DQiiKasOv9cbSpQe084n8ImJaSpBz6RifHx9qKu6:FQX8l7GbenZ/51iKZLje0848YwEROI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
ad738fd7090dad85f0f26f85241d5d30_JaffaCakes118

Files

ad738fd7090dad85f0f26f85241d5d30_JaffaCakes118
.exe windows:4 windows x86 arch:x86

782299aee4714017a651d52f7152ba62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\inetpub\Temp\js3tojr85tt39jb20qakl1if83\Stub.pdb

Imports

msvcrt

__p__commode
__p__fmode
__set_app_type
_adjust_fdiv
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
_except_handler3
free
memcpy

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
LoadLibraryA
GetProcAddress
WaitForSingleObject
CreateThread
GetModuleHandleA
IsDebuggerPresent

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 870B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ