d60499a5c2625865a064ffd182fc25e8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d60499a5c2625865a064ffd182fc25e8_JaffaCakes118
Size

35KB
MD5

d60499a5c2625865a064ffd182fc25e8
SHA1

30dfcd5b0d53a995047af25c1b7d679a7776deb0
SHA256

cc5b7b71020581125e328a9911ae9ec60c5bffbd8ae2cb452f2dadcb43a4f103
SHA512

f92faff1814dc7904e6d3e833e01749b73ef6d08f3135adafdb4f3d6359f1d6d7ca53959603f89286832af1a9ca24fa35351f891bc3d15063c2901b2d524c009
SSDEEP

384:j+OHE58b2DXhqenU3Ep5QzFAjQNTlaTtiU3nI5J7qjePg/hBYBr9EpRp3EFd46mP:j+xhqN3EphQNpagUX2rYTYr9wOW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d60499a5c2625865a064ffd182fc25e8_JaffaCakes118

Files

d60499a5c2625865a064ffd182fc25e8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c73c1c072787c41fa94e14b9960945ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
CreateFileA
MoveFileExA
FreeLibrary
WriteFile
GetSystemDirectoryA
lstrcatA
lstrcmpiA
GetProcAddress
LoadLibraryA
MoveFileA
GetModuleFileNameA
WinExec
CloseHandle
DeleteFileA
lstrcpyA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

user32

CopyIcon
LoadCursorA
SetSystemCursor

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 986B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ