d6728b5b958292e20d97a3bc218cd8fb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6728b5b958292e20d97a3bc218cd8fb_JaffaCakes118
Size

831KB
MD5

d6728b5b958292e20d97a3bc218cd8fb
SHA1

2d619c04ca171cea410f8dc51688e82a8a0c7382
SHA256

2f745a4c35cc53651c0abf4e7f51516e33c8d05bed603cdb9b05025bc6075a14
SHA512

53832a3ebca10de8f2c2a663f6db3e23fb76bc980f5430960f83e5665b83708b888a05841cac66e7f7535ac09fd582fb7b8c166c25d5db85cc9b86a37880cf19
SSDEEP

24576:TRaOEWAxMgMDO3lFNsPR5B5hDSs0y2xUMct0:TRBSMq3ljqR7jWzy50

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6728b5b958292e20d97a3bc218cd8fb_JaffaCakes118

Files

d6728b5b958292e20d97a3bc218cd8fb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

586c5892ea383d72e5066369ff5d742f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
GlobalAlloc
GetTickCount
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
HeapAlloc
CreateFileA
ExitProcess

shell32

SHBrowseForFolderA
SHGetDesktopFolder

iphlpapi

AddIPAddress

secur32

CompleteAuthToken

powrprof

GetPwrCapabilities

Exports

Exports

antiemu30

Sections

.text
Size: 821KB - Virtual size: 821KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bdd
Size: - Virtual size: 57KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 857B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ