f9ea012f89273e0a12011112bc003bc4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9ea012f89273e0a12011112bc003bc4_JaffaCakes118
Size

5KB
MD5

f9ea012f89273e0a12011112bc003bc4
SHA1

1bdf83f6fd86a96a6a9d24a79bf27a9571f26f3f
SHA256

b94935d7ac20e9fc1d10a74b6aae49a692b11c65ef95fb3d652bbadee893e046
SHA512

ac3e926ceb154bd43a83963bee77f7a7e4b3364c4f04c60ebf677320bbaa7796f12b3699b34dd88196b24a338500c6dcae5f141a0cc43dfb213b122123353a70
SSDEEP

48:Kb07mNn38vzuu5QBsu1Q1caQhoF+orfNY7cSYnyhqkFywdoqP4oyl1:VWn3OepuKqF+ojNVSYaq4ywdoqP4oyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9ea012f89273e0a12011112bc003bc4_JaffaCakes118

Files

f9ea012f89273e0a12011112bc003bc4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d9239bb3f749dd2a9abcb3d94b48432

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlInitUnicodeString
ZwOpenSection
ZwClose
memset

kernel32

VirtualLock
LocalFree
FormatMessageA
VirtualUnlock
Sleep
GetCurrentThread
SetThreadPriority
GetLastError
MapViewOfFile

advapi32

SetEntriesInAclA
SetSecurityInfo
GetSecurityInfo

msvcrt

_controlfp
_except_handler3
printf
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE