14c98d797b43a91d3edf453d963a05b7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14c98d797b43a91d3edf453d963a05b7_JaffaCakes118
Size

37KB
MD5

14c98d797b43a91d3edf453d963a05b7
SHA1

0de837f8bb4f088fbc273fc801c85484e17e1c55
SHA256

6935d98019aa831a6e75f4995abb3d3d657980b30b93b64587c43433fac9189a
SHA512

6e370f68cca22925287ab51ea3fe7f14a02ae46f26d4e6b3680da0cee68ca52c2cbd73e4215cbb7cf95ff06e550ebfa105475bb55e13a8ebacdd076e98ee7732
SSDEEP

384:fqombaDXP5LmlZHm1yyyEFhkkSoEXlXUlrcCYsZMUJfh5JEaQSIkI:fdm2XRjyKFKFXlOcJstHJVQZ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14c98d797b43a91d3edf453d963a05b7_JaffaCakes118

Files

14c98d797b43a91d3edf453d963a05b7_JaffaCakes118
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

0aeffe9e142f7a9339e56f2b23b6fb76

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
LCMapStringW
LCMapStringA
HeapAlloc
TlsAlloc
GetStringTypeA
GetLastError
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetStringTypeW

user32

ScreenToClient
ShowCursor

gdi32

GetMapMode
CancelDC
CombineTransform

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ