dd0aaa17e13a7d54814e6feb1a3612a4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd0aaa17e13a7d54814e6feb1a3612a4_JaffaCakes118
Size

38KB
MD5

dd0aaa17e13a7d54814e6feb1a3612a4
SHA1

12517242fa6b6904dbcf2bf3c769348cb9178d13
SHA256

bb13133ae9ee5090fc8767ee0617c641dc492da58bf804a273d09f91ac67b8fd
SHA512

802192bf3cd20ece5d08b19ca1ef5550284e2d1511700aa6ef61004a851e8f040726cbf3a58c5e160fa2f969625f1d98ccb9cde81c2c612d28ea50a665d51d40
SSDEEP

384:/4Qh5qqqFcI2on1cQsSm2YqLfuRDmsiwS/oP+FBlDo+5aja/D2xds31v/3U9rtTg:wQh5V+cdPKY3SF99D2x+31v/UZtX9i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd0aaa17e13a7d54814e6feb1a3612a4_JaffaCakes118

Files

dd0aaa17e13a7d54814e6feb1a3612a4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7828d59efe9e84a1fc639c916a1e091e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

CheckSumMappedFile

kernel32

GetCurrentProcessId
VirtualFree
GetTempPathA
CloseHandle
WriteFile
CreateFileA
VirtualAlloc
ExitProcess
LoadLibraryA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
Sleep
QueryPerformanceCounter
ReadFile
SetFilePointer
GetProcAddress
FreeLibrary
GetVersion

advapi32

RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegSetValueExW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 162B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ