e12c03aa59ab386384bf41b057cb8594_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e12c03aa59ab386384bf41b057cb8594_JaffaCakes118
Size

36KB
MD5

e12c03aa59ab386384bf41b057cb8594
SHA1

ececf874d57f9f9d1a62f36c2d1d13cfcd035316
SHA256

1956f8d8f22b49c16695cf9887b67498478059c7f1abe958acb0d99c13bba4ea
SHA512

1599df8b2eb3d0462fa2baf129fb30705a009f5a21c8d1ee2316bdc67649dc4778cc48473285f67ca4fd9d0c2d17bf2bce6d9ca2a5db50326e4da321b9cddefe
SSDEEP

384:wm0q5812DXhq+nU3EO5QzFAj3arF6T8a7U38I5J7qjeld4BYBrt/5Ro3oF/5P:wmThqt3EOh3ax6rUs2rYYrtYyR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e12c03aa59ab386384bf41b057cb8594_JaffaCakes118

Files

e12c03aa59ab386384bf41b057cb8594_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c73c1c072787c41fa94e14b9960945ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ExitProcess
CreateFileA
MoveFileExA
FreeLibrary
WriteFile
GetSystemDirectoryA
lstrcatA
lstrcmpiA
GetProcAddress
LoadLibraryA
MoveFileA
GetModuleFileNameA
WinExec
CloseHandle
DeleteFileA
lstrcpyA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

user32

CopyIcon
LoadCursorA
SetSystemCursor

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 986B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ