09980b7349b4983cc97c1ba129880e56_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09980b7349b4983cc97c1ba129880e56_JaffaCakes118
Size

52KB
MD5

09980b7349b4983cc97c1ba129880e56
SHA1

36f2ac548e323319b4cf02108431fd45c9e2f05b
SHA256

ace412e1dd44fd617976568a94475ee71facc64a263853da435973b2173b8d64
SHA512

0b24e537cb098f63cbc253b870bb3083950346fb444e19ff50ab907bb963ac790d934ed8ba3f503900c85555254bf6d062b6839781d01dc7639f38ebe0e1e438
SSDEEP

1536:CyHRHe52C3Vd6ro18NMXs/uQXFgTRvy4B:1x+5t3/6k1CpzWI4B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09980b7349b4983cc97c1ba129880e56_JaffaCakes118

Files

09980b7349b4983cc97c1ba129880e56_JaffaCakes118
.exe windows:4 windows x86 arch:x86

31a75b51e2474130b2d2a802a293d720

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
ExitProcess
lstrcmpiA
VirtualProtect
IsBadReadPtr
GetProcAddress
LoadLibraryA
CreateThread
GetModuleHandleA
GetStartupInfoA

user32

SetTimer
DefWindowProcA
TranslateMessage
DispatchMessageA
KillTimer
SendMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
GetMessageA

msvcrt

_acmdln
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_exit
_XcptFilter
exit
__getmainargs

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE