be132e3a843f052616a54cc7ec571bed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be132e3a843f052616a54cc7ec571bed_JaffaCakes118
Size

80KB
MD5

be132e3a843f052616a54cc7ec571bed
SHA1

8aaf5ac2285ca14de82015d83ad37d8cad2c5d70
SHA256

b5eda5156aa67d116018ab73a6e663ff976147850f6cc50363c31c41e267a617
SHA512

acbe44c2e0be6d360fc7dccb732754e2a7119c79eb9887058e4fe04d5fe90a6742d5c99ae0c71edf81800fa99b0424080474cbd11e866b7069a2e007eab9cb9f
SSDEEP

1536:27XhBv+8txmPa5/uuV0xBF2S4JNAL8qmXSMaAAkxCkNoWbCGd4fbDP:27hBvrbmYC54JNOXcSMmkwHWbDd4P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be132e3a843f052616a54cc7ec571bed_JaffaCakes118

Files

be132e3a843f052616a54cc7ec571bed_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8e0890cd29643509891174d00643b732

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

atl

AtlMarshalPtrInProc

ntdll

NtAddAtom

kernel32

SetLastError
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
GetCurrentProcessId
LoadLibraryW
GetCurrentThreadId
VirtualAlloc
GetTickCount
GetModuleHandleA
QueryPerformanceCounter

Sections

.textbss
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ