d2385dee765cd058d0d26a7afc23cd98_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d2385dee765cd058d0d26a7afc23cd98_JaffaCakes118
Size

3KB
MD5

d2385dee765cd058d0d26a7afc23cd98
SHA1

10f1b1517c041d54d2a8ed401104759936576fe7
SHA256

72a7d750a04c674a0dff0abc1308def4750d9f0fd8c5bd7e9c9b6577ebb85cab
SHA512

e0adfa17d20b84260bf95fb9b448d52850556112e48a4974d235f1626348f35b667065b3f27ac43bea1f172fbc9273782d51500a0e769e024534308e6f2dee85

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2385dee765cd058d0d26a7afc23cd98_JaffaCakes118

Files

d2385dee765cd058d0d26a7afc23cd98_JaffaCakes118
.exe windows:5 windows x86 arch:x86

da05e741124a405093cd0e6360e09f26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlNtStatusToDosError
NtCreateFile

activeds

FreeADsMem

kernel32

VirtualAlloc
GetProcessHeap
FreeConsole

crypt32

RegQueryValueExU

Sections

.textbss
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ