d05987a24edadaa15cbff0085289bd72_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d05987a24edadaa15cbff0085289bd72_JaffaCakes118
Size

107KB
MD5

d05987a24edadaa15cbff0085289bd72
SHA1

7fe58a0b9e4d4716557737107829095ad3280f74
SHA256

f62b2ff7b624ed207080fafc163afd88318ea25dd5570edab1a7a1a4c53768df
SHA512

4baddf622adedd94e2cf8f358e7161b260fa3784d3ced08779771d048da96068816b0752c410bd7e5c58340f4fecc301608c1d328e7cf596952e300dddbedbc5
SSDEEP

3072:UN9Ar6An6R8z+BlfzjCBj+/R6LLD6No9rp4vW5:UHC6AnK8zuVzGj++coO+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d05987a24edadaa15cbff0085289bd72_JaffaCakes118

Files

d05987a24edadaa15cbff0085289bd72_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a90eb02797a3efbf421e5b63f85557b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
VirtualProtect
ExitProcess

user32

LoadIconA
SetWindowPos

shell32

SHGetMalloc

msvcrt

_except_handler3

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.texx
Size: 1024B - Virtual size: 709B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stls
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ