d646efae3d6ac00e80477bcdc69a71f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d646efae3d6ac00e80477bcdc69a71f9_JaffaCakes118
Size

26KB
MD5

d646efae3d6ac00e80477bcdc69a71f9
SHA1

ca4478f4b7d77cc28da6be2b80602bfe417f4716
SHA256

492f9bd2f2423c1f675b9982f5739acd8fe76b454333f069c13740f44f832a3c
SHA512

77847e1c1fd7b7bd02c16e7c94e36c8f9fce9f60b80b3381a397733a59c894181fee23bd2671791d1189c2f4eee5bc4fdafe4d38479691d414e2ae9b84f77015
SSDEEP

768:xvNPsq1lDf+kMwpwPE+AHs6pfoR9CiQgOp:xvNPsqPCA9+AH5QR9Kp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d646efae3d6ac00e80477bcdc69a71f9_JaffaCakes118

Files

d646efae3d6ac00e80477bcdc69a71f9_JaffaCakes118
.exe windows:6 windows x86 arch:x86

77b5712277e4dbd07cb7a64407c84a3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
MapViewOfFile
FindClose
GlobalFree
FreeLibrary
GetProcAddress
CreateDirectoryA
CreateFileW
GlobalLock
SetComputerNameA
Process32First
CreateMutexA
OpenProcess
GetModuleFileNameA
CreateProcessA
Process32Next
GetLastError
LoadLibraryA
GetVolumeInformationA
GetFileTime
GlobalUnlock
GetModuleFileNameW
GetThreadPriority
ReadFileEx
GetWindowsDirectoryA
GlobalMemoryStatus
SleepEx
FileTimeToSystemTime
GetShortPathNameA
GetTempPathA
CreateFileMappingW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.nkh
Size: - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE