25747cbf961950d9d483d8b15b166696_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

25747cbf961950d9d483d8b15b166696_JaffaCakes118
Size

367KB
MD5

25747cbf961950d9d483d8b15b166696
SHA1

64e1ff5b9c337d433e81881fd130909f13e39125
SHA256

de30307f348b918c0c13c37d35ba980b7c46d5fbd4c0f19a03f0708cdbb7aa73
SHA512

ed773d32d251335fd9f84a72a9e94f3c63fa28525ee45e5d854f94bbf991052841470fd38a6325f481dec6394a24b037a5a59e63aa3ffa199d5cc475deb6b646
SSDEEP

6144:xoqU8jYFdauzWk8BvfRyra1J1zZZ/PSn/s/VC3V6HH6JDweG:xor8TIxKfRD1zZN8u08HODweG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25747cbf961950d9d483d8b15b166696_JaffaCakes118

Files

25747cbf961950d9d483d8b15b166696_JaffaCakes118
.exe windows:5 windows x86 arch:x86

aeea4399c3ff53fc245aaf8419919963

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetModuleHandleW
CancelTimerQueueTimer
ClearCommBreak
CopyFileA
AddAtomW
FindAtomW
TerminateProcess
FatalExit
GetConsoleCP
SetUnhandledExceptionFilter
GetCurrentThreadId
BeginUpdateResourceW
EnterCriticalSection
Sleep
DeleteCriticalSection
LeaveCriticalSection
CreateMemoryResourceNotification
WideCharToMultiByte
DeactivateActCtx
GetConsoleNlsMode
GetLastError
CloseHandle
CreateMutexW
GetSystemTimeAsFileTime
DeleteTimerQueue
ExitThread
CreateFileW
AllocConsole
ExitProcess

Sections

.text
Size: 343KB - Virtual size: 342KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ