ae25476f185f18343fd8f9b674187c3e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ae25476f185f18343fd8f9b674187c3e_JaffaCakes118
Size

456KB
MD5

ae25476f185f18343fd8f9b674187c3e
SHA1

f13a458933395c39e43c5eacc13ba725a723c25b
SHA256

1c45270aa6c6b64fa85e75ab7b1c48fd914ff0944b3230aaed615cfbc716559d
SHA512

320f54d38071da7cce2f3523fe2ff712c5945bc8f49519a72775aded4dde2846c3314d4f51e7045b75d28633e603efad1f8a1c271248e8c36fd95152876c3220
SSDEEP

12288:F6/H25Z+e1q+d2CpVYwYOjqpKZyivMCQ+ZzQhcE:U/U+e1qQ2CpKujqplYdQz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae25476f185f18343fd8f9b674187c3e_JaffaCakes118

Files

ae25476f185f18343fd8f9b674187c3e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

97f25f4e07424500451356743027724a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\#development\__project_VM\Vm\Start\Release\Start.pdb

Imports

shlwapi

PathRemoveExtensionW
PathFindExtensionW

kernel32

LoadLibraryW
CreateThread
WaitForSingleObject
CloseHandle
WriteFile
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
FreeLibrary
GetProcAddress
ExitProcess
CreateProcessW
lstrcatW
lstrcpyW
GetModuleFileNameW
FindResourceW

user32

wsprintfW
LoadStringW

Sections

.text
Size: 1024B - Virtual size: 883B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE