c195feefbf26ab25724642fb5194ab41_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c195feefbf26ab25724642fb5194ab41_JaffaCakes118
Size

46KB
MD5

c195feefbf26ab25724642fb5194ab41
SHA1

73774fd841b66df610c44b19f943bc1d259ed860
SHA256

645dcc575bb5b8a7e0841a67d36bc3f2499bfbf9af7735670c469c3528f1f2d1
SHA512

8627562dc9d46afdbc643deaaf237f3ac6b8bf700660500ac5e1057304700403ca1503001e77e2c3b11ad3ae3ebf91f75590aacd795b1132a8f23a8838fd00e6
SSDEEP

768:ic72zw92uK46mYVFNtk/h6uLn+2FD9j5g2L49me2HFmmah7qIZ0EbkmG:1wU2D46pVr+/hHLzd5g2c9me2HFtQ7q4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c195feefbf26ab25724642fb5194ab41_JaffaCakes118

Files

c195feefbf26ab25724642fb5194ab41_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d0c56ccff4ee9a5a3362066bc0610b7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

atl

AtlMarshalPtrInProc

ntdll

NtAddAtom

kernel32

FreeLibrary
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetProcAddress
LoadLibraryW
VirtualAlloc
QueryPerformanceCounter
GetModuleHandleA

Sections

.textbss
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ