d112132d27f9b6e84cb9784200b64303_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d112132d27f9b6e84cb9784200b64303_JaffaCakes118
Size

788KB
MD5

d112132d27f9b6e84cb9784200b64303
SHA1

1ed600d73eb2d91a26a6fad885e78019a1e59f57
SHA256

ffba5c94c4f84db082950b8ac931a6259dd8b201b8d65b032bf416c40be5b6e2
SHA512

f255ebce177fa7125fb33acd26c7e0f9b9b941c7aa4d41ea0a40c624f72c082caa2db91b98af9b554401f69ec28b55e6e6329bdb9a2a0e2c6643f7b5a6ee9397
SSDEEP

12288:azUA4iOjq4LISO9yU1R74xUdY9zkWd2xexgUWUGlso6bDn4m0q:SUA1x19BR839zMxSBWUGlszn4m0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d112132d27f9b6e84cb9784200b64303_JaffaCakes118

Files

d112132d27f9b6e84cb9784200b64303_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6f2ac99555222ced914f97ba61769a9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_acmdln
__set_app_type
_except_handler3
_controlfp
exit
_XcptFilter
_exit
memmove
memcpy
??3@YAXPAX@Z
__p__fmode
??2@YAPAXI@Z

user32

LoadMenuA

kernel32

GetProcAddress
CreateThread
WaitForMultipleObjects
CloseHandle
GetModuleHandleA
GetStartupInfoA
LoadLibraryA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 778KB - Virtual size: 778KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ