fb4e92305afed4628009aea9f15cbab3_JaffaCakes118 | Triage

Sharing

General

Target

fb4e92305afed4628009aea9f15cbab3_JaffaCakes118
Size

25KB
MD5

fb4e92305afed4628009aea9f15cbab3
SHA1

196180fdf4a35a8a2be2291209e0b15224143c0f
SHA256

9c59627aa7c89648517d3d13f6fbc22bc23776075320a4e370925fb7430b5e20
SHA512

598cef02865526dc65d16460a285d01f5af1077f06a13b6d885792259d9aa6be573ea211e29be0c62ae62483f989572af77bf572797f876dab4e0435ec27361c
SSDEEP

384:CZyvsGZESf/Pb4lmPK11/LmYMvpAoVu78cQIkmV72Nb:Uw5Cb116JvpALJQILVaN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb4e92305afed4628009aea9f15cbab3_JaffaCakes118

Files

fb4e92305afed4628009aea9f15cbab3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5c4aa7fb37569307936f0f0b6e3551fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
lstrlenA
WriteFile
GetProcAddress
CloseHandle
ExitProcess
MoveFileExA
GetCurrentProcess
Sleep
CreateEventA
GetComputerNameExA
TerminateProcess
GetSystemDirectoryA
lstrcatA
lstrlenW
LoadLibraryA
OpenEventA
GetModuleFileNameA
lstrcpyA

shlwapi

StrToIntA

ole32

StringFromCLSID

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE