14f59cc840a69dfcc2f78e1df52552e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14f59cc840a69dfcc2f78e1df52552e0_JaffaCakes118
Size

719KB
MD5

14f59cc840a69dfcc2f78e1df52552e0
SHA1

25bb806a029b0b46e0a6ac1efbf737a14cc55c06
SHA256

2ab3ecc38c4cdebba2c8d6251ce9297330810ac0594a5b610a4876d03b149375
SHA512

8baf306593bae42d7333e404285f35c0818a71f8c6e7e55d930e7b02645a709f6320974afa79cfdab9f772014fae53ea248212edd494324d4a2cda76ae938d89
SSDEEP

12288:7YdHz7oZV2j5W2Q6Y2BVQ428W+vqWt0S9SiPYZZz1SHU1vOjYt/8DIhd7OHYdHz9:7e7QwtWeBVl2b+vhOUpkpSHU1r/eIhd9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14f59cc840a69dfcc2f78e1df52552e0_JaffaCakes118

Files

14f59cc840a69dfcc2f78e1df52552e0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

53e92335e74fd01f0d86758a87341ec2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteW

iphlpapi

GetAdaptersInfo

ws2_32

gethostbyaddr

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 68KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 585KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sfekeir
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE