d2b7c64389abca98d342911db0fadfb4_JaffaCakes118 | Triage

Sharing

General

Target

d2b7c64389abca98d342911db0fadfb4_JaffaCakes118
Size

125KB
MD5

d2b7c64389abca98d342911db0fadfb4
SHA1

ee12057a3b190f55cbb5a3a5aac80ba401b37e56
SHA256

d4264dccc6248816b1388ee92425aa8a3a74fffdac969501ad77f13388664acc
SHA512

8be016348163ea5a9871a3089f25d7adb892c5187ba1d05c94775553776d544e7cb0cf7b5d5382214a54340b70fb8416f2a8c5a9df7e959cc3edd83a056328b6
SSDEEP

3072:NRtoUHQY6TRSg7dsbxbZUfFDDI+C1q8V6shtLHUd5LSKGj1Q:1QxRdCZU93I51qYYcj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2b7c64389abca98d342911db0fadfb4_JaffaCakes118

Files

d2b7c64389abca98d342911db0fadfb4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

baca703340435ab2724a9c8657f34f0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
LoadLibraryA
lstrcatA
GetSystemDirectoryA
CreateFileA
WriteFile
GetProcAddress

user32

LoadCursorA
LoadIconA

gdi32

GetStockObject

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 466B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ