e082d9d29dc451fe1ad3c20055b20838_JaffaCakes118 | Triage

Sharing

General

Target

e082d9d29dc451fe1ad3c20055b20838_JaffaCakes118
Size

455KB
MD5

e082d9d29dc451fe1ad3c20055b20838
SHA1

eea826a5c2bd3b3daca68ac512335ddba3a0aafd
SHA256

d04b95ece68a3fe4343b4fa6983883cf5df943bdd24b71bf1cad372de4b2b9fa
SHA512

4437ac216cc4d3dc843cc821d320e840d1e2522746eb29f3902d9d42b4a6ab46478fc1918a78347279f2b5f4e8b56ab4729e18df7d9e796d4ea34f8e80493a09
SSDEEP

12288:ztwpqp1M3gtw4p9Sw2n0pdTDEjh/7+20gC/B9Wdq:zsqp1M3oZ9Sw2n0g/7r0/poI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e082d9d29dc451fe1ad3c20055b20838_JaffaCakes118

Files

e082d9d29dc451fe1ad3c20055b20838_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f41e154fcaf92e8bbba638c6ea5d619f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProfileStringW
VirtualProtect
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentThreadId

msvcrt

time
strncmp
fclose
fread
fseek
fopen
gmtime
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
_memicmp

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 392KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ