dc8f15a8ae1beeff2a35943607fce434_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dc8f15a8ae1beeff2a35943607fce434_JaffaCakes118
Size

20KB
MD5

dc8f15a8ae1beeff2a35943607fce434
SHA1

3b3e4359525aecb2ff5f1ad2c3de268345e31793
SHA256

54974f6a1eb844f256bb7f1aa1cbd7ad3610ff721bcffe823f0f2dc1ded8017d
SHA512

13c85a8563d15a67a0e0628712fdcead023f2739bbd3b7be9b87fa7f97ca0653c9687511c33d116ec29926c81ef96ed65fdfea7b2ac36385966d20ae0e92123e
SSDEEP

384:A2M4HoOOs6Hj0wKfKfLTcJw2aTOhqsp33Bdns/v6gNkBoZ4x:A2IOwjKfKfLyNhFBZSiG9+x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc8f15a8ae1beeff2a35943607fce434_JaffaCakes118

Files

dc8f15a8ae1beeff2a35943607fce434_JaffaCakes118
.exe windows:5 windows x86 arch:x86

08da5ec80406581b76eae64d14e4f631

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\bamboo-home\xml-data\build-dir\SPOONVM-VM3-JOB1\vm\Build\Output\x86\StubExe.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
GetCurrentProcess
GetCommandLineW
OpenProcess
GetLastError
DuplicateHandle
GetVersionExW
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
OpenFileMappingW
SetEvent
GetFileSizeEx
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
LoadLibraryW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 856KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ