14cb6090166641d1380d0e321882a079_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14cb6090166641d1380d0e321882a079_JaffaCakes118
Size

5KB
MD5

14cb6090166641d1380d0e321882a079
SHA1

27690d5802254b59f2ef586e28eaf2e69c26246d
SHA256

9ebc95a6784ab7226e1837776be4df4696cd5ed045124bb0a2abd36817180f25
SHA512

244f12a3f59975846131b361d7a3c1d118325f419bf677380e1cc3a693af42712e86c44b32e334b8d45563660daef43f36eabf660e8a648f8ff2af6bdace0f42
SSDEEP

48:6xjMIHvJBtfvxtRN/WuKK8YBbeFTMzXtXRwZJCSCX8:Yj/hBtfvRN/WPUbMTdCt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14cb6090166641d1380d0e321882a079_JaffaCakes118

Files

14cb6090166641d1380d0e321882a079_JaffaCakes118
.exe windows:5 windows x86 arch:x86

470d291ad1f6d2e239ee246b61db154f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo.pdb

Imports

kernel32

Sleep
GetTickCount
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
CreateProcessA
FreeLibrary
WriteFile
CreateFileA
GetEnvironmentVariableA
GetSystemDirectoryA
GetProcAddress
LoadLibraryA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ