029963d230fd8b4481ac78747a769abc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

029963d230fd8b4481ac78747a769abc_JaffaCakes118
Size

30KB
MD5

029963d230fd8b4481ac78747a769abc
SHA1

2f665cb795c3dfa8cb20f6cb80ec2b5e1856a54e
SHA256

d443d924bf7fc27fa2616cf72e3ca058d7e92299d2f4bc0d5aa17a2315572bc2
SHA512

f518ba53e2758c55c855274c960db41d639a5cd87ef87568166d47dd974119eb89ca1224ffb0db0313b17e0c7b5afc32db56306c84d3751997598b355a195604
SSDEEP

768:028Tttn5QbmACpiAf7HR+V0YWqGkjYVgvA8d+:R8TfnqCi89+V0YWOYGA8g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
029963d230fd8b4481ac78747a769abc_JaffaCakes118

Files

029963d230fd8b4481ac78747a769abc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

de37167d102ceffeb6b3faeebfaa27f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatus
GetCurrentDirectoryA
SetConsoleNumberOfCommandsA
GetPrivateProfileSectionNamesA
GetEnvironmentStringsA
FormatMessageA
OpenProfileUserMapping
CreateProcessInternalA
RtlMoveMemory
GetCommandLineA
ExitProcess
GetStartupInfoA

Sections

itext
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

text
Size: 22KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

idata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ