b618c72ac87b3de03708a30aeb5f0bd8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b618c72ac87b3de03708a30aeb5f0bd8_JaffaCakes118
Size

10KB
MD5

b618c72ac87b3de03708a30aeb5f0bd8
SHA1

0292d9b7b3da6009cdfef0295b3d86f67511af5d
SHA256

6c13353757dabe88d0c3a792d38e40cb961c4f44df9021e98d97ff0d463924d1
SHA512

2fef49b02e884d7ea96d28fac66c9cc09523e51b13c48da61cf3868fe39e345debd68742c2f36b21c42cff20e7781662a6f6b3f35be966c02947ccb33e9bf55d
SSDEEP

96:0H/KmodAs7uyuKjz9oBjCD3Rf7AYpYFXGJkOtJyg4DJDM11MDEWcU3mG:0Bod5qCCCD3RDXpaGJ1KDJD/IWcUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b618c72ac87b3de03708a30aeb5f0bd8_JaffaCakes118

Files

b618c72ac87b3de03708a30aeb5f0bd8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9ed54609127a70e312733e0fe986dabe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

hh.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoA
GetTickCount
QueryPerformanceCounter
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcpyA
GetCurrentThreadId

user32

wsprintfA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE