ec0922b9223f1645bb8f6897c599f180_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec0922b9223f1645bb8f6897c599f180_JaffaCakes118
Size

32KB
MD5

ec0922b9223f1645bb8f6897c599f180
SHA1

fba04502d88bfe89729fedb0c1cb29042dfcb7e4
SHA256

f89af4984a9b26ebfa3980a74949fd01aa3dc47f8d139f3d37c15ada16d2ff74
SHA512

24b00f9718c867c0384ae44e9e175cf976b3c8d5c63208369d480f9efee703e6492e2cbee893e44d9fda979ca2d665dcea8ab0fbe4a501fd2f24e9c9a869e72d
SSDEEP

768:Sv3IOXlYGHySOCmFd9QYP+A+xwWOcibnUqeWPqqGwxm7DTjd:cdXuGHyLCmFX3P/9c/quqGZJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec0922b9223f1645bb8f6897c599f180_JaffaCakes118

Files

ec0922b9223f1645bb8f6897c599f180_JaffaCakes118
.exe windows:6 windows x86 arch:x86

1cfb71944a1c1ea1062e114ac8dc8d7f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

appvisvsubsystems32

ord1

vcruntime140

strstr

msvcp140

_Mtx_lock

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-string-l1-1-0

strncpy_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.MPRESS1
Size: 25KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE