fb9b0923d5825b98e605fbcbac67bb50_JaffaCakes118 | Triage

Sharing

General

Target

fb9b0923d5825b98e605fbcbac67bb50_JaffaCakes118
Size

114KB
MD5

fb9b0923d5825b98e605fbcbac67bb50
SHA1

9c356d6ba5aa0fab49041c8903e4239cfdf732dd
SHA256

93d24bf57584c1e0fc75a99e7ce1f7d845f7709b9a289975e8e496623958d222
SHA512

7f41ed6c9a70538cb5efb191e9af38160c719f968732f4f30b96ea65a29a5a69ba4316465a221f75729519e86bd7ff1cbe9ec36287e973b02c88f10fca848869
SSDEEP

3072:2RHZWQgYjUJapCJhR9EoD9wZ9QX8nhhBQuQ:YZ5g4UJCOhUoZw7QufQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb9b0923d5825b98e605fbcbac67bb50_JaffaCakes118

Files

fb9b0923d5825b98e605fbcbac67bb50_JaffaCakes118
.exe windows:5 windows x86 arch:x86

baca703340435ab2724a9c8657f34f0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
LoadLibraryA
lstrcatA
GetSystemDirectoryA
CreateFileA
WriteFile
GetProcAddress

user32

LoadCursorA
LoadIconA

gdi32

GetStockObject

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ