d5ab9dad05863b768dcd46c8af89cee2_JaffaCakes118 | Triage

Sharing

General

Target

d5ab9dad05863b768dcd46c8af89cee2_JaffaCakes118
Size

672KB
MD5

d5ab9dad05863b768dcd46c8af89cee2
SHA1

9e14622e883f26b12355676947c93df1c5221431
SHA256

749d0779d3a80219360d71c25e87ee5fb3cbcf260362ff6272733c7d283f5d24
SHA512

e2377d1b65f96c95416f817dff05f40c76e66a1d6b252398e081d67cbed9e38880b3835ad33249ef31c230e66dd6ec2fdcab960ca2af69f32e4b7ed172be9d63
SSDEEP

12288:OmDslhIwKjutLjJaCVNjqlKQR14WItuQl:OmnwKjwNWlKOS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5ab9dad05863b768dcd46c8af89cee2_JaffaCakes118

Files

d5ab9dad05863b768dcd46c8af89cee2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

53b338a5a343440770be2403e59415fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
QueryPerformanceCounter
Sleep
HeapCreate
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleFileNameA
GetTickCount
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
CloseHandle

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE