cf8e5e7892d4df791a77ce4201463ead_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf8e5e7892d4df791a77ce4201463ead_JaffaCakes118
Size

17KB
MD5

cf8e5e7892d4df791a77ce4201463ead
SHA1

7400723ca793f368257d67a0609a642f3bb4d5bf
SHA256

15fb04b04e8c56f5b4c448db1fb374cfc65881bb4596519930d303aa5b838971
SHA512

1bc014a622b8c5c40f4959613ae143040a3cbcf66ff8c6e626456f91f7bd7b2501690fe3372e126c225e8825003e29c4d8672eb028e94852ef78ca2774e35338
SSDEEP

384:C4h/EFIlLZq5oR4vrFC+EmhxPVV513fs:CgcFI1I51C4hxtdPs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf8e5e7892d4df791a77ce4201463ead_JaffaCakes118

Files

cf8e5e7892d4df791a77ce4201463ead_JaffaCakes118
.exe windows:5 windows x86 arch:x86

75fe55b67adf616dcbaf64f7a9f569a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitProcess
lstrcatW
RtlUnwind
TerminateProcess
GetCurrentProcess
IsDebuggerPresent

user32

LoadIconA

advapi32

RegOpenKeyExW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aat2a
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ