12b3fdb6aa1fdb8779b4705c815eb0a2_JaffaCakes118 | Triage

Sharing

General

Target

12b3fdb6aa1fdb8779b4705c815eb0a2_JaffaCakes118
Size

382KB
MD5

12b3fdb6aa1fdb8779b4705c815eb0a2
SHA1

9ea1ad0303a34b8be07df2d5c3df946d1febe93b
SHA256

68f652f560622651a6579d76dc8110ae1b080b5e7b82729b3c639626eee06b5d
SHA512

2f0b79b6a762ac09b98de3d0a549d5ee10af15bb609c528e947b7caa9406dfa7d7c6a5d076d15a0db77bc51cfdc720fcf3d8373a7d11e5794d0110431029187a
SSDEEP

6144:fXYhyIyDyw3G5STW/hG/pyDOmtF6cIJY1StCEsLjJoxGq6IEeNW:fXYhZw3G7/hSpyDF+ti1YChFYGq6oN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12b3fdb6aa1fdb8779b4705c815eb0a2_JaffaCakes118

Files

12b3fdb6aa1fdb8779b4705c815eb0a2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4582ffdd7eb98cb63a937096204182b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
GetCurrentProcessId
OpenFileMappingW
GetLastError
MapViewOfFile
CloseHandle
CreateFileW
CreateFileMappingW
UnmapViewOfFile
GetFileInformationByHandle
VirtualAlloc
VirtualFree
GetModuleHandleA
GetProcAddress
LoadLibraryW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 36KB

.idata
Size: 1024B - Virtual size: 626B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ