08ca57678e70b1428128fa1a389dcb29_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08ca57678e70b1428128fa1a389dcb29_JaffaCakes118
Size

80KB
MD5

08ca57678e70b1428128fa1a389dcb29
SHA1

cdadbb6623e1448ed358d704fdc138dc90e839eb
SHA256

b0ff2e60d75805d3d260622c07cc39b24c7011997506f47238d754a58cad79b6
SHA512

58878b9f2e1c8acb1cc104f04e0daa4fbc8144e2b859552dffcb228b4e8f6d503eb436d4b4246e6f21f6d4f12f57fe7cecfc7378fc15143712bea84476e5a6aa
SSDEEP

1536:Gn9mZPKqUMojp2b0au5WYY4J1gwIzoy38BKjfNIA2f+6xkAxLdsq:G9/HNjIoauoYRSAwbNIfxtaq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08ca57678e70b1428128fa1a389dcb29_JaffaCakes118

Files

08ca57678e70b1428128fa1a389dcb29_JaffaCakes118
.exe windows:5 windows x86 arch:x86

442f40746d8defaa39948ae47694c48b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\tmp\test.pdb

Imports

kernel32

GetVersionExA
CreateThread
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
Sleep
GetTickCount
RtlUnwind
TerminateProcess

user32

MessageBoxA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 466B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ