d4c0e82f421896bd32ccf786932569ab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d4c0e82f421896bd32ccf786932569ab_JaffaCakes118
Size

125KB
MD5

d4c0e82f421896bd32ccf786932569ab
SHA1

ca5b489cb49a7457eed3087434b5345b0c1601f1
SHA256

3d1a203836d26f1aabeff858156e1e7c9525fd39b6c631c42f1bc3265128c37b
SHA512

0938509d2d53b1c72caa863e36bdec9147c5390c05f1b71b3aa33b07101ad10f1b2f83138f9b5293006fe7b9e665f1757da58a81a7a5d134c288de5fa264704e
SSDEEP

3072:IvHbmgojMLGTUmuAmiug1KjDR8Va4Lh/YPXhUTITDj:IvHbmgojMwaAnug1cDaaPxUTS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4c0e82f421896bd32ccf786932569ab_JaffaCakes118

Files

d4c0e82f421896bd32ccf786932569ab_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2ba6438a5cf3d526f8b41f260938957a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlComputeCrc32
RtlImageDirectoryEntryToData
RtlUnwind
NtQueryVirtualMemory

kernel32

SearchPathW
ExpandEnvironmentStringsW
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
LeaveCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW

comctl32

ord17

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ