b9298e02cf87d2bb575b9d409b7311d5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9298e02cf87d2bb575b9d409b7311d5_JaffaCakes118
Size

14KB
MD5

b9298e02cf87d2bb575b9d409b7311d5
SHA1

3b6be54939b12ac1e04afc6e2d7c3079a988cf4e
SHA256

2809ad480ac1520f52d67679f5d81fb6a1a6ef7b78fe14037ba4cbd16ee05d1c
SHA512

9d7fcd415d0cefae03d12dd012bbd58f64b0b923526040d9824871e5f5f7e9ab2a6a36bb494bf9f0148ed8a42a35fc7f10f81adbb2ace452248168426c0c2013
SSDEEP

96:gSuratZhAI0IvZQdAqayqAQcwuoBfEIkYwtT/Q6oU4vwRdSw0Lq9pE6iIkjzPuPJ:Dl3wPpDjARTBuzC80PlP1oynFWp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9298e02cf87d2bb575b9d409b7311d5_JaffaCakes118

Files

b9298e02cf87d2bb575b9d409b7311d5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5562d7de73aa4f931c43f8216b29a603

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__set_app_type
_except_handler3
__p__fmode
_controlfp
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
??3@YAXPAX@Z
_stricmp
memset
memcpy

kernel32

WriteProcessMemory
IsDebuggerPresent
GetModuleHandleA
GetModuleFileNameA
VirtualAllocEx
GetProcAddress
GetStartupInfoA
CreateProcessA
SetThreadContext
GetThreadContext
ExitProcess
ResumeThread

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 234B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ