137e5ac56e54244aee20f0a4102295e2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

137e5ac56e54244aee20f0a4102295e2_JaffaCakes118
Size

92KB
MD5

137e5ac56e54244aee20f0a4102295e2
SHA1

a6604663ccd9bc438b47bd874b7aff24a576c529
SHA256

e6c2056128ca8d6adaa85d6cae36f2a390c4032b0d844c624348e70643785976
SHA512

b6aa1917152770a694c126d069ca85f16e59ef3c2effea605a9ee0b7574ba6fdc98704c4170d763da4120ff9eebd16b5189ce9f8f9d09ccb3c46d32808493f2f
SSDEEP

1536:lF4P4cPwyoJvtl5V8c7rNSnTPhEhKLMGoIWabLy2aakI9FcSqOQ/Sf:lmP4cwycvtV8wrNSnbtQvIDm21kI/9qE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
137e5ac56e54244aee20f0a4102295e2_JaffaCakes118

Files

137e5ac56e54244aee20f0a4102295e2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b2c8f614b1ad234e0cf6f413d45bf55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GlobalLock
GetCommandLineA
GetStartupInfoA
ExitProcess

ntdll

NtAccessCheckAndAuditAlarm
NtSetInformationObject
RtlFreeHeap
RtlCompareString
NtQueryMultipleValueKey
ZwImpersonateThread
ZwCreateEventPair
ZwDeleteKey
NtCurrentTeb
RtlSetUserValueHeap
NtWriteFile
RtlCopySecurityDescriptor
RtlSecondsSince1970ToTime
RtlFreeOemString

Sections

.text
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

weIJUNLi
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ